AES-256 is quantum safe by every authoritative standard published as of 2026. The Advanced Encryption Standard with a 256-bit key survives Grover's algorithm, the only known quantum attack against a generic symmetric cipher, with roughly 128 bits of post-quantum effective security. NIST treats AES-256 as Category 5 (its highest post-quantum security tier). NSA's CNSA 2.0 explicitly names AES-256 as the only symmetric cipher approved for protecting US classified information in National Security Systems through 2070 and beyond. The mathematical structure of AES, combined with the practical cost of Grover at scale, makes 256-bit keys infeasible to brute-force on any plausible quantum computer.
This blog post answers the simplest version of the post-quantum cryptography question. The short answer is yes. The long answer requires understanding Grover's algorithm, what it does to AES, what authoritative bodies have ruled, and where the practical edges are (because they exist).
What AES-256 Is
AES is the Advanced Encryption Standard, defined in NIST FIPS 197 (originally published 2001, latest revision May 2023). It is a 128-bit block cipher with three key-size variants: AES-128, AES-192, and AES-256. The number after the dash is the key length in bits.
AES-256 has:
- 14 rounds of substitution, permutation, and key mixing.
- A 256-bit key derived through the AES key schedule into 15 round keys.
- A 128-bit block size (the same as AES-128 and AES-192).
AES-256 has no known classical attack that does better than brute-force on the key. Generic brute-force of a 256-bit key requires 2^256 operations, which exceeds the number of atoms in the observable universe and the energy budget of the Sun's lifetime.
| AES-256 Property | Value |
|---|---|
| Standard | NIST FIPS 197 |
| Block size | 128 bits |
| Key size | 256 bits |
| Rounds | 14 |
| Classical brute-force cost | 2^256 |
| Best classical cryptanalysis | None faster than brute-force |
| Grover quantum cost | ~2^128 quantum operations |
| NIST post-quantum category | 5 (highest) |
| NSA CNSA 2.0 status | Approved |
| FIPS 140-3 module status | Validated in dozens of modules |
What Grover's Algorithm Does
Grover's algorithm, published by Lov Grover in 1996, is a quantum search algorithm. Given an unstructured search space of N items and an oracle that recognizes the target item, Grover finds the target in O(sqrt(N)) oracle calls, versus O(N) classical calls.
Applied to a symmetric cipher key search:
- Classical brute-force on an n-bit key: 2^n operations.
- Grover brute-force on an n-bit key: 2^(n/2) quantum operations, plus the same number of oracle invocations.
For AES-256: 2^128 quantum operations. For AES-128: 2^64 quantum operations.
Grover's quadratic speed-up is the only generic quantum attack on AES. There are no known structural quantum attacks that exploit the round function, the S-box, or the key schedule. The cipher is generic-cryptanalysis-resistant against quantum computers.
Why 128 Bits of Post-Quantum Security Is Enough
NIST and NSA both ground their AES-256 quantum-safety position on the practical cost of 2^128 quantum operations.
Resource-estimate studies, starting with Grassl, Langenberg, Roetteler, and Steinwandt's "Applying Grover's Algorithm to AES" (PQCrypto 2016) and refined repeatedly since, agree on the shape of the answer. Practical Grover on AES-256 requires:
- A fault-tolerant quantum computer with millions to billions of logical qubits.
- Continuous operation for years or decades to complete the search.
- Energy costs measured in petawatt-hours.
For comparison, the largest publicly disclosed fault-tolerant quantum computers in 2026 have on the order of hundreds of logical qubits. The gap between current hardware and Grover-on-AES-256 is many orders of magnitude.
Cryptography engineer Filippo Valsorda wrote in a widely cited essay that quantum computers are not a threat to 128-bit symmetric keys. The argument extends a fortiori to 256-bit keys.
What NIST Says
NIST FIPS 197 (the AES standard itself) does not address quantum computing. NIST FIPS 203, 204, and 205 (the post-quantum standards for ML-KEM, ML-DSA, and SLH-DSA) explicitly compare PQC parameter sets against AES Categories 1, 3, and 5:
- Category 1: at least as hard as breaking AES-128.
- Category 3: at least as hard as breaking AES-192.
- Category 5: at least as hard as breaking AES-256.
NIST's PQC FAQ at csrc.nist.gov states that NIST not only considers AES-128 to be safe, but made it the benchmark for the security of post-quantum primitives. AES-192 and AES-256 will still be safe for a very long time even if quantum computers turn out to be much less expensive than anticipated.
What NSA CNSA 2.0 Says
NSA's Commercial National Security Algorithm Suite 2.0, published September 2022 and updated May 2025, names AES-256 as the only symmetric cipher approved for protecting US classified information in National Security Systems.
The CNSA 2.0 suite is:
| Function | Algorithm | Status |
|---|---|---|
| Symmetric encryption | AES-256 | Approved |
| Key encapsulation | ML-KEM-1024 | Approved (FIPS 203) |
| Digital signature | ML-DSA-87 | Approved (FIPS 204) |
| Firmware signing | LMS or XMSS | Approved (NIST SP 800-208) |
| Hash function | SHA-384, SHA-512 | Approved (FIPS 180-4) |
NSA's timeline for CNSA 2.0 deployment:
- Software signing: preferred 2025, required 2030.
- Networking equipment: preferred 2026, required 2030.
- Operating systems: preferred 2027, required 2033.
- Niche custom systems: updated or replaced by 2033.
- All NSS by 2031, exclusive PQC by 2033.
The crucial point: AES-256 is not on the migration list. It is the destination. Every other algorithm in NSS is moving toward AES-256 plus a PQC partner. AES-256 itself is staying.
The Practical Cost of Grover, In Numbers
Even if the attacker has a perfect, error-corrected quantum computer running at the theoretical limit, the cost of breaking AES-256 by Grover is:
- 2^128 ≈ 3.4 × 10^38 quantum oracle invocations.
- If the oracle runs at 1 trillion (10^12) iterations per second, the search takes 3.4 × 10^26 seconds.
- That is 1.1 × 10^19 years.
- The age of the universe is 1.4 × 10^10 years.
- AES-256 would take roughly 10^9 (a billion) ages of the universe.
This is why the cryptographic consensus is that AES-256 is fine. Not "fine, with risk." Fine, period.
For AES-128 the same calculation gives:
- 2^64 ≈ 1.8 × 10^19 oracle invocations.
- At 10^12 per second, the search takes 1.8 × 10^7 seconds = 213 days.
That is feasible for a sufficiently capable quantum adversary. NIST therefore prefers AES-256 (or AES-192) for long-term security. AES-128 remains acceptable for short-lived keys where 64 bits of post-quantum security suffices.
Modes of Operation and Quantum Analysis
AES is a block cipher. To encrypt data longer than 128 bits, you wrap AES in a mode of operation: ECB (insecure, do not use), CBC, CTR, GCM, OCB, or XTS. The mode does not change Grover's analysis. Grover attacks the underlying block cipher key, not the mode.
| Mode | Authenticated | Quantum analysis |
|---|---|---|
| ECB | No | Same key as AES-256, Grover unchanged |
| CBC | No | Same key as AES-256, Grover unchanged |
| CTR | No | Same key as AES-256, Grover unchanged |
| GCM | Yes (GHASH polynomial MAC) | Same key as AES-256, Grover unchanged |
| OCB | Yes (built-in MAC) | Same key as AES-256, Grover unchanged |
| XTS | No (disk-encryption mode) | Same key as AES-256, Grover unchanged |
For confidentiality with integrity, prefer GCM or OCB.
Where AES-256 Is Not Enough
AES-256 is the cipher core. It does not solve every problem:
- Key exchange: AES needs a shared key. Modern key exchange uses public-key cryptography (Diffie-Hellman, ECDH, RSA) which Shor's algorithm breaks. For quantum-safe key exchange, use ML-KEM. Read hybrid encryption.
- Signatures: AES does not sign. Signatures use RSA, ECDSA, or EdDSA, all Shor-broken. For quantum-safe signatures, use ML-DSA, SLH-DSA, or FN-DSA.
- Password derivation: AES needs a key. If the key comes from a password, the password-to-key function (PBKDF2, scrypt, Argon2) is the practical attack surface. Grover halves the password search space.
- Side channels: AES implementations can leak the key through timing, power consumption, electromagnetic emissions. Hardware AES (AES-NI on Intel/AMD, the AES engine on the Apple Secure Enclave) mitigates most of these.
AES-256 is quantum safe as a cipher. The system around AES-256 may not be.
Comparing AES-256 to Other Symmetric Ciphers
| Cipher | Key sizes | Quantum status |
|---|---|---|
| AES-256 | 256 bits | Quantum-safe (CNSA 2.0 approved) |
| AES-192 | 192 bits | Quantum-safe (NIST Category 3) |
| AES-128 | 128 bits | Borderline (NIST Category 1, but acceptable for short-lived keys) |
| Camellia-256 | 256 bits | Quantum-safe (Grover halves to 128) |
| ChaCha20 | 256 bits | Quantum-safe (stream cipher, Grover halves to 128) |
| Serpent-256 | 256 bits | Quantum-safe (Grover halves to 128) |
| Twofish-256 | 256 bits | Quantum-safe (Grover halves to 128) |
| 3DES | 112 bits effective (168-bit key) | Borderline classically, weak post-quantum |
| DES | 56 bits | Broken classically, trivial post-quantum |
For 256-bit-key symmetric ciphers, the quantum analysis is the same: Grover halves the effective key length to 128 bits, which remains computationally infeasible.
Frequently Asked Questions
Is AES-256 quantum safe in 2026?
Yes. AES-256 with 256-bit keys survives Grover's algorithm with approximately 128 bits of post-quantum effective security. NIST and NSA CNSA 2.0 both treat AES-256 as quantum-safe through at least 2070. No structural quantum attack on AES is known.
How does Grover's algorithm affect AES-256?
Grover provides a quadratic speed-up over classical brute-force, reducing the search complexity from 2^256 to roughly 2^128 quantum operations. That is still computationally infeasible. Even with a perfect quantum computer running at 10^12 operations per second, brute-forcing AES-256 would take roughly 10^19 years, which is a billion times the age of the universe.
Why is AES-256 in NSA CNSA 2.0?
NSA selected AES-256 as the symmetric cipher in CNSA 2.0 because it provides Category 5 post-quantum security (matching the highest NIST tier) and has decades of cryptanalytic scrutiny without any known structural weakness. CNSA 2.0 requires AES-256 in combination with ML-KEM-1024 for key encapsulation and ML-DSA-87 for signatures.
Should I switch from AES-256 to a different cipher for quantum protection?
No. AES-256 is the cipher to use. Switch only if you need integrity guarantees (use AES-256-GCM or AES-256-OCB instead of AES-256-CBC), or if you are on a platform without hardware acceleration where ChaCha20-Poly1305 is faster.
Is AES-128 still safe against quantum computers?
Borderline. AES-128 has roughly 64 bits of post-quantum security against Grover, which a sufficiently capable adversary could in principle break. NIST and NSA recommend AES-256 for long-term security in quantum-aware deployments. AES-128 remains acceptable for ephemeral session keys with limited lifetimes.
Sources
- NIST FIPS 197, Advanced Encryption Standard, https://csrc.nist.gov/pubs/fips/197/final
- NSA CNSA 2.0 Algorithms, https://media.defense.gov/2022/Sep/07/2003071834/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS_.PDF
- NIST FIPS 203 ML-KEM, https://csrc.nist.gov/pubs/fips/203/final
- NIST FIPS 204 ML-DSA, https://csrc.nist.gov/pubs/fips/204/final
- NIST Post-Quantum Cryptography FAQ, https://csrc.nist.gov/projects/post-quantum-cryptography/faqs
- "Applying Grover's Algorithm to AES: Quantum Resource Estimates", Grassl, Langenberg, Roetteler, Steinwandt, PQCrypto 2016
- "Quantum Computers Are Not a Threat to 128-bit Symmetric Keys", Filippo Valsorda, https://words.filippo.io/128-bits/
What QNSQY Does Differently
QNSQY uses AES-256 (in GCM mode for authenticated encryption) as its symmetric core, wrapped by a NIST FIPS 203 ML-KEM hybrid KEM. The default configuration is ML-KEM-768 + X25519 hybrid (matching NIST Category 3 and the OpenPGP PQC draft). Higher-tier users can select ML-KEM-1024, matching the CNSA 2.0 algorithm selection. Signatures use ML-DSA-65 by default, with ML-DSA-87, SLH-DSA, and FN-DSA available.
Where a tool like 7-Zip or VeraCrypt gives you AES-256 as the only quantum-relevant primitive, QNSQY layers PQC key exchange and signatures on top so the entire envelope, not just the cipher, is post-quantum. See the download page for the current Linux CLI build.
Related Articles
Protect Your Data Before Q-Day Arrives
QNSQY's NIST-standardized post-quantum encryption protects data against both current and quantum-era threats.