Analysis: Quantum computers do not pose a threat to a 128-bit symmetric key. The "post-quantum cryptography" has been subject to panic-misinterpretation.

**April 21: Quantum Computers Won’t Crack 128-Bit Symmetric Encryption Anytime Soon, Expert Argues** Cryptography engineer Filippo Valsorda said this week that real-world quantum computers won’t break 128-bit symmetric encryption (like AES-128) anytime soon—even with the fastest possible development pace. The current "post-quantum cryptography" panic, he noted, stems from a common misunderstanding. In his article *Quantum Computers Do Not Threaten 128-Bit Symmetric Keys*, Valsorda debunked the myth that the Grover algorithm would "halve" a symmetric key’s security (reducing 128 bits to 64 bits of protection). This claim ignores Grover’s critical practical flaw: it can’t be parallelized efficiently. Its steps must run serially, and forcing parallelization would skyrocket total computing costs. Even an ideal quantum computer would need ~2^104.5 operations to crack AES-128—tens of billions of times more expensive than breaking today’s asymmetric encryption (e.g., RSA, ECDSA)—making the task completely unrealistic. Organizations like the U.S. NIST, Germany’s BSI, and quantum cryptography experts have all confirmed AES-128 is sufficient against known quantum attacks, setting it as a post-quantum security benchmark. NIST even advises in its official Q&A: *"You should not double AES key lengths to counter quantum threats."* Valsorda’s core recommendation: The only urgent post-quantum task is replacing vulnerable asymmetric encryption. Upgrading symmetric keys (128→256 bits) is unnecessary—it wastes resources, diverts focus, increases system complexity, and raises coordination costs. The industry should focus solely on what needs updating.