What quantum computing changes
Grover's algorithm, symmetric cryptography, and hash functions
A quadratic speedup is real but far smaller than what Shor's algorithm does to public-key cryptography — why AES-256 and SHA-256 stay on NIST's list of acceptable algorithms.
8 min read · 7 min 9 sec film
What you'll be able to do
- State what Grover's algorithm does, and why a quadratic speedup is a far smaller effect than what Shor's algorithm does to public-key cryptography.
- Explain why the claim that Grover's algorithm reduces AES-256 to AES-128 overstates its real-world impact.
- State NIST's current guidance on AES-128, AES-256, SHA-256, and longer hash digests.
Lesson film
Watch: Grover's algorithm, symmetric cryptography, and hash functions
The second quantum algorithm is real, and far smaller than the first — which is why AES and SHA-2 stay exactly where they are.
7 min 9 sec · 9 scenes
7 min 9 sec, narrated by your browser's voice. Captions and a full transcript are below — nothing here needs sound.
There is a second quantum algorithm, and it is the one that gets misquoted in planning meetings.
With the player focused: Space plays or pauses, ← → seek ten seconds, Home restarts, M toggles narration.
Full transcript
1. The other algorithm
2. What Grover does
3. Quadratic vs exponential
4. The idealised bound
5. Why the bound is not reached
6. What NIST says
7. Hash functions
8. What this saves you
9. Takeaway
The written lesson
Lov Grover's 1996 algorithm searches an unsorted space of N possibilities in roughly the square root of N steps instead of N — a quadratic speedup, not the exponential one Shor's algorithm gives against public-key cryptography. Applied to brute-forcing a symmetric key, that quadratic speedup is the entire quantum threat to AES, and it is a far smaller effect.
Hash functions fare similarly well in current guidance. SHA-2 and SHA-3 are not practically broken by quantum computers. SHA-256 remains acceptable; a longer digest such as SHA-384, SHA-512, SHA3-384, or SHA3-512 may add margin for the property the application needs. Digest length, collision resistance, and preimage resistance are distinct measurements.
| Primitive | Classical strength | Quantum-era guidance |
|---|---|---|
| AES-128 | 128-bit | NIST continues to consider this acceptable |
| AES-256 | 256-bit | Leaves ample margin against Grover-style speedups |
| SHA-256 | 256-bit digest | Not practically broken by quantum computers; remains acceptable |
| SHA-384 / SHA-512 / SHA3-384 / SHA3-512 | 384- or 512-bit digest | Adds margin for some uses; not a mandatory replacement |
This is the reason a PQC migration is, overwhelmingly, a public-key cryptography migration. Symmetric ciphers and hash functions are not where the standards work has focused, and this course does not ask you to replace them.
A hash digest length is not a universal security-strength number. For a well-behaved n-bit digest, classical collision search takes roughly 2^(n/2) work, while finding a preimage has a different cost. Applications such as signatures can depend on collision resistance; a password storage scheme has different concerns again. State the property being used before comparing hash sizes.
Primary reading and claim sources
Publication status checked on the date shown. Draft guidance can change.
- Post-Quantum Cryptography FAQsNIST · Current project guidance · checked 2026-09-26
- SP 800-57 Part 1, Revision 5: Recommendation for Key ManagementNIST · Final guidance; check for later revisions · checked 2026-09-26
Marking a lesson complete only updates this browser.