# What does Grover's algorithm mean for AES?

Much less than Shor's algorithm means for RSA: it weakens symmetric encryption and hashing, but does not break them. Lov Grover showed in 1996 that a quantum computer can search through possibilities in about the square root of the usual number of steps. Applied to guessing a key, that roughly halves the key length in bits: in theory, a 128-bit AES key behaves more like a 64-bit one. In practice the attack is one very long chain of steps that cannot be usefully split across many machines, so even AES-128 stays far from easy to break. The common advice is simple: use AES-256 for data that must stay secret for a long time, and SHA-256 or stronger for hashing. Most modern systems already support both, so this part of the change is usually a configuration choice, not a migration project. The real work lies with the public-key methods.

FAQ: [Post-quantum cryptography](https://netsenx.com/en/faq/pqc) · https://netsenx.com/en/faq/what-does-grovers-algorithm-mean-for-aes

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/features
- https://netsenx.com/en/blog/2026-10-27_harvest-now-decrypt-later

## Related questions

- [When will a quantum computer break RSA?](https://netsenx.com/en/faq/when-will-a-quantum-computer-break-encryption)
- [What is post-quantum cryptography?](https://netsenx.com/en/faq/what-is-post-quantum-cryptography)
- [What are FIPS 203, 204 and 205?](https://netsenx.com/en/faq/what-are-fips-203-204-and-205)
- [What is ML-KEM?](https://netsenx.com/en/faq/what-is-ml-kem)
- [What are ML-DSA and SLH-DSA?](https://netsenx.com/en/faq/what-are-ml-dsa-and-slh-dsa)