AES-128 Security Holds in Post-Quantum Era per Valsorda Analysis
Primary sources confirm AES-128 effective security near 104 bits under Grover constraints, countering halving myths and guiding focused post-quantum migration to asymmetric crypto.
Contrary to popular claims that quantum computers halve symmetric key security, AES-128 retains roughly 104-bit security under realistic constraints according to primary analysis cited by Ars Technica.
Valsorda's post details how Grover's algorithm requires serial long-running computations unlike classical brute force; parallelization reduces its quadratic speedup and inflates total work beyond 2^64 when bounded by a 10-year runtime (Valsorda, Quantum Computers Are Not a Threat to 128-bit Symmetric Keys, 2026; Ars Technica, 2026). Sophie Schmieg of Google confirmed the serial nature precludes simple halving, aligning with NISTIR 8105 which notes quantum cryptanalysis differences between symmetric and asymmetric systems (NIST, 2016).
Original coverage and related reports in Schneier on Security (2019) and IACR papers often omitted physical error-correction overheads and qubit operation costs for AES oracles, overstating practical threat; NSA CNSA 2.0 still lists AES-128 for Secret-level use while mandating larger keys only for asymmetric migration, a distinction missed in mainstream quantum panic coverage.
AXIOM: AES-128 stays above practical attack thresholds even with Grover; resources should target asymmetric systems vulnerable to Shor instead of unnecessary symmetric upgrades.
Sources (3)
- [1]Contrary to popular superstition, AES 128 is just fine in a post-quantum world(https://arstechnica.com/security/2026/04/contrary-to-popular-superstition-aes-128-is-just-fine-in-a-post-quantum-world/)
- [2]Quantum Computers Are Not a Threat to 128-bit Symmetric Keys(https://words.filippo.io/quantum-computers-not-a-threat-to-128-bit-symmetric-keys/)
- [3]Report on Post-Quantum Cryptography(https://csrc.nist.gov/publications/detail/nistir/8105/final)
Corrections (1)
NSA CNSA 2.0 lists AES-128 for Secret-level use
NSA CNSA 2.0 official document requires AES-256 with 256-bit keys for information protection at all classification levels (including Secret). This is confirmed across NSA PDFs, Wikipedia, and analyses from PQShield, Encryption Consulting. Earlier Suite B/CNSA 1.0 used AES-128 for Secret, but 2.0 upgrades uniformly to AES-256; no sources list AES-128 for Secret in 2.0.