What quantum computing changes
Grover's algorithm, symmetric cryptography, and hash functions
A quadratic speedup is real but far smaller than what Shor's algorithm does to public-key cryptography — why AES-256 and SHA-256 stay on NIST's list of acceptable algorithms.
7 min read
What you'll be able to do
- State what Grover's algorithm does, and why a quadratic speedup is a far smaller effect than what Shor's algorithm does to public-key cryptography.
- Explain why the claim that Grover's algorithm reduces AES-256 to AES-128 overstates its real-world impact.
- State NIST's current guidance on AES-128, AES-256, SHA-256, and longer hash digests.
Lov Grover's 1996 algorithm searches an unsorted space of N possibilities in roughly the square root of N steps instead of N — a quadratic speedup, not the exponential one Shor's algorithm gives against public-key cryptography. Applied to brute-forcing a symmetric key, that quadratic speedup is the entire quantum threat to AES, and it is a far smaller effect.
Hash functions fare similarly well. SHA-2 and SHA-3 are not practically broken by quantum computers. SHA-256 remains acceptable; where a system already uses a longer digest — SHA-384, SHA-512, or a SHA-3 variant — that simply adds margin, not a requirement to switch.
| Primitive | Classical strength | Quantum-era guidance |
|---|---|---|
| AES-128 | 128-bit | NIST continues to consider this acceptable |
| AES-256 | 256-bit | Leaves ample margin against Grover-style speedups |
| SHA-256 | 256-bit digest | Not practically broken by quantum computers; remains acceptable |
| SHA-384 / SHA-512 / SHA-3 | Longer digest | Adds margin; not a mandatory replacement |
This is the reason a PQC migration is, overwhelmingly, a public-key cryptography migration. Symmetric ciphers and hash functions are not where the standards work has focused, and this course does not ask you to replace them.
Marking a lesson complete only updates this browser.