Based on 5 minutes of reading about Grover's algorithm, I don't see how a practical quantum computer (an analog system) can repeat an operation 2^64th times to break an 128 bit key without some bias towards interaction in the qubits involved. You'd have to have 1/(2^128) attenuation between each and every channel for that to even work reliably. That's 380 dB of signal to noise ratio. Typically 40 or 50 dB of isolation is all you get between channels in communications systems.
[Edit -- Additional considerations]
In order for Grover's algorithm to work, you have to implement your conventional algorithm in Quantum hardware, with perfect fidelity. Digital computers can do this just fine because every gate is also a comparator, so signal to noise ratio isn't an issue. I fail to see how a quantum gate can possibly operate with enough fidelity to even just copy the input state after 2^64 stages, let alone complex logic AND the Grover Diffusion Operator.
Isn't the whole point of QC that a classical computer needs to do 2^64th calculations to try 64 bits of data in a function BUT a QC just needs 64 QBits, because each Qbit can be both 0 and 1 simultaneously? This effectively turns a time problem (2^64th operations) into a memory one (64 qbits and 1 operation over all of them, maybe repeat 10 times for error detection).
Qubits are NEVER both 0 and 1 simultaneously... they might be either at any given moment. Qubits are a vector in 3 dimensions of unit length, best illustrated with the Bloch Sphere[1] In this sphere Up, where Z=1 is written as |0> because of history.
One of the most common Quantum Logic Gates[2], the Hadamard gate performs a rotation of a diagonal axis half way between X and Z. This gate is used many, many times in Grover's algorithm
There are many such rotations in quantum computing. Error correction can only ensure that a state is at either end of an axis, not at the correct point anywhere on the sphere.
You would think so, but no. The correction is only to ensure the resultant measured qubit is correct.
Grover's algorithm apparently relies on very small phase angles iterated very many times, which is beyond the capabilities of current forms of quantum error correction.
Because i find it really hard to believe there will ever be an O(sqrt(n)) classical algorithm for unstructured search. How could there possibly be?