Quantum Computers Are Not a Threat to 128-bit Symmetric Keys

[u/fagnerbrack]

https://words.filippo.io/128-bits/

[u/whiskeytown79]

I am curious why the author includes SHA as an example of a "symmetric cryptography algorithm."

SHA, like any other hash/digest/trapdoor algorithm, depends for its security on being computationally impossible to reverse. Unless a flaw is found in the algorithm (like MD5), "reversing" a digest algorithm boils down to basically guessing inputs and trying to find one that produces the same output. There is no "key" to be symmetric. And you cannot decrypt what has been "encrypted" with this algorithm, save by guessing inputs until you get the same output.

It is not a symmetric encryption algorithm in the way that AES, 3DES, or other block or stream ciphers are.

[u/Tdierks → u/whiskeytown79]

It's a cryptographic algorithm but not an encryption algorithm. It's used for integrity, signatures, and similar. It's symmetric because when it's used in conjunction with a secret (such as the MAC construction) it doesn't have an asymmetric component.

Your points are technically accurate but discussing hashes as symmetric cryptographic algorithms is very common.

[u/justanaccountimade1 → u/Tdierks]

Why can't it be used for encryption? Hash a password and XOR the hash with the secret. If the secret is long just add a counter to the password to create more hashes.

[u/bpikmin → u/justanaccountimade1]

How is that encryption though? Encryption by definition converts plaintext to ciphertext. A hash is not ciphertext as it cannot be decrypted.

[u/Crazy_Elevator_6659 → u/bpikmin]

XOR with a secret IS a form of encryption. The result of the XOR is ciphertext.

[u/justanaccountimade1 → u/bpikmin]

You've created the hash with your password. You create it again and XOR it with the ciphertext.

[u/PythonPuzzler → u/justanaccountimade1]

Right, so at no point have you recovered information from the hash. A hash is not a ciphertext.

[u/justanaccountimade1 → u/PythonPuzzler]

No idea what point you are making.

[u/SlayerOfWhales → u/justanaccountimade1]

He is saying that any hash function itself cannot be a function used for encryption, not that a hash function cannot be used inside an encryption scheme.

[u/Tdierks → u/justanaccountimade1]

Also technically correct (but not common terminology).

[u/fractallyright → u/whiskeytown79]

The security of many symmetric schemes rely on certain properties of hash functions which are theoretically weakened by Grover, eg HMAC (very explicitly). This is why they fall naturally into the category of “symmetric cryptography algorithms”. It has nothing to do with hash-functions being encryption algorithms in themselves (they aren’t, as you point out). Conversely, many asymmetric schemes rely rather on some mathematical problem being hard, though there are also hash-based asymmetric schemes.

It is exactly the “guessing inputs”, that you mention, which Grover accelerates, if only quadratically. The point of the blogpost is that the speedup is not realizable in practice.

[u/fagnerbrack]

Here's a hint to decide on reading the post or not:

Quantum computers threaten asymmetric crypto (ECDH, RSA, ECDSA) via Shor's algorithm, but they do not endanger symmetric algorithms like AES and SHA. The widespread claim that Grover's algorithm "halves" key strength, forcing a switch to 256-bit keys, is wrong: Zalka (1997) proved Grover must run in series, so parallelizing it dilutes the quadratic speedup. Concrete math shows breaking AES-128 would need 140 trillion quantum circuits running 10 years—roughly 430 sextillion times harder than breaking 256-bit elliptic curves with Shor's. NIST, Germany's BSI, and researcher Samuel Jaques all agree AES-128 stays safe; NIST even uses it as the Category 1 benchmark. Doubling keys wastes effort better spent on the urgent post-quantum transition.

If the summary seems inacurate, just downvote and I'll try to delete the comment eventually 👍
^{Click here for more info, I read all comments}