BlockBeats report: On April 21, cryptographer Filippo Valsorda argued in an article that even under the most optimistic development scenarios, real-world quantum computers will not be able to break 128-bit symmetric encryption in the foreseeable future, and that current concerns about "post-quantum cryptography" are based on misinterpretations and panic. In his piece, "Quantum Computers Do Not Pose a Threat to 128-Bit Symmetric Keys," he stated that quantum computers do not present a practical threat to 128-bit symmetric keys such as AES-128, and that the industry does not need to upgrade key lengths for this reason.
Filippo Valsorda points out that many people worry quantum computers will "halve" the effective security strength of symmetric keys via Grover’s algorithm, reducing a 128-bit key to only 64 bits of security—but this is incorrect. This misconception arises from ignoring key limitations of Grover’s algorithm in practical attacks. The main issue with Grover’s algorithm is its inability to be effectively parallelized; its steps must be executed sequentially, and forcing parallelization drastically increases total computational cost. Even with an idealized quantum computer, the total computational effort required to break an AES-128 key is astronomical—approximately 2¹⁰⁴·⁵ operations—billions of times greater than the cost of breaking current asymmetric encryption algorithms, making it entirely impractical. Current standardization bodies such as the U.S. NIST and Germany’s BSI, along with quantum cryptography experts, explicitly state that algorithms like AES-128 are sufficient to resist known quantum attacks and serve as the benchmark for post-quantum security. NIST directly advises in its official Q&A: “Do not double AES key lengths to counter the quantum threat.”
Filippo Valsorda ultimately recommends that the only urgent task in the current post-quantum migration is replacing vulnerable asymmetric encryption algorithms such as RSA and ECDSA. Allocating limited resources to upgrading symmetric keys—such as increasing from 128-bit to 256-bit—is unnecessary, distracts from critical priorities, and increases system complexity and coordination costs; efforts should be fully focused on the components that truly require replacement.