[grandsham]

quantum computers, at best, divide the bit-strength of a symmetric key like AES in half[1]. Brute forcing a 128 bit key is theoretically possible (in the sense that you can do it if you marshal the entire world energy output to the cause, you could crack 1 key/yr), but not a 5 minute process.

[1]https://en.wikipedia.org/wiki/Grover%27s_algorithm

[the8472]

that is assuming that there is no better quantum algorithm for aes specifically. grover's algorithm is only optimal if brute force search is the only possible approach and there are no other exploitable properties.

considering that there already theoretical attacks that (marginally) faster than brute force on classic computers who knows how much more one could squeeze out with quantum algorithms.

Of course those are fairly speculative concerns.

[nullc]

It's very obvious how special structure exists in cryptosystems that use finite cyclic groups, such as in discrete log cryptosystems.

But in AES? that sounds unlikely and really unfortunate.

I think it's more likely that large quantum computers would aid in mathmatical exploration that uncovers currently unknown vulnerabilities that could be exploited by classical systems.