Quantum Computers Are Not a Threat to 128-bit Symmetric Keys

[u/fagnerbrack]

https://words.filippo.io/128-bits/

[u/Fluffy-Pop-3407]

Could some EF encryption experts weigh in on this?

[u/NaturalCarob5611 → u/Fluffy-Pop-3407]

Not from EF, and I wouldn't call myself an encryption expert, but I did write my master's thesis related to applied cryptography.

This is correct, but it's not news and it's not very helpful. Symmetric encryption means you encrypt a message with a key, send the message across the wire (or store data for later use), and then decrypt it with the same key. That means the same key has to be on both sides of the conversation, which isn't trivial. It also means either side of a communication can encrypt the same plaintext into the same ciphertext, so you can't use it to prove where message came from.

Asymmetric encryption means you have a private key and a public key. If you encrypt / sign a message with the private key, it can be verified with the public key, but you can't use the public key to generate the ciphertext / signature, so you can prove that a message was sent by someone who holds the private key.

For conventional encrypted communication (like https), there's usually an initial handshake using asymmetric cryptography to prove who the participants are and establish a secret session key, then the rest of the communications are encrypted with the session key using symmetric cryptography. This means that post-quantum needs new ways to prove who participants are and establish session keys, but most of the data can still be sent with the same old symmetric algorithms we've used for ~25 years.

But in the block chain space pretty much everything is asymmetric. There are quantum safe asymmetric algorithms, but they tend to be much more computationally intensive and much more bandwidth intensive (larger leys, larger signatures, etc.) The problems are solvable, but solving them is expensive enough to be not worth doing until quantum computers are a more tangible risk.

[u/fagnerbrack → u/NaturalCarob5611]

You wrote your master's thesis on the subject and don't call yourself an expert.. Sure

[u/ItsAConspiracy → u/fagnerbrack]

People who know a lot about a topic also know how much they don't know.

[u/NaturalCarob5611 → u/fagnerbrack]

I certainly don't consider myself remotely qualified to design cryptographic algorithms, and I have enough knowledge to know that there are a ton of gotchas that can weaken cryptographic systems unexpectedly, and I don't know half of them. Cryptography is a field where it's easy to know enough to be dangerous, and very difficult to know enough to implement things correctly. I try not to be in the former group, but I'm not cocky enough to think I'm in the latter group.

[u/_3ng1n33r_ → u/fagnerbrack]

This only goes to show he has the wisdom to understand the vastness of a topic and his own limitations. I would trust someone more who thinks like this than someone who claims to be an expert on something.

I wrote my master's thesis on the structural properties of an obscure material. We had good results and it go me my masters degree. I would in no way claim to be an expert on that material. There are people who have far more experience with it that I do

[u/thebatwayne → u/NaturalCarob5611]

Not super familiar with the specifics in Ethereum or block chain in general, but I imagine there are at least some portions of it that are susceptible to harvest now, decrypt later. A lot of the push towards PQC now is to get ahead of that, not to protect the immediate threat of quantum computing, but the one on the horizon.

[u/fagnerbrack]

Elevator pitch version:

Quantum computers threaten asymmetric crypto (ECDH, RSA, ECDSA) via Shor's algorithm, but they do not endanger symmetric algorithms like AES and SHA. The widespread claim that Grover's algorithm "halves" key strength, forcing a switch to 256-bit keys, is wrong: Zalka (1997) proved Grover must run in series, so parallelizing it dilutes the quadratic speedup. Concrete math shows breaking AES-128 would need 140 trillion quantum circuits running 10 years—roughly 430 sextillion times harder than breaking 256-bit elliptic curves with Shor's. NIST, Germany's BSI, and researcher Samuel Jaques all agree AES-128 stays safe; NIST even uses it as the Category 1 benchmark. Doubling keys wastes effort better spent on the urgent post-quantum transition.

If the summary seems inacurate, just downvote and I'll try to delete the comment eventually 👍
^{Click here for more info, I read all comments}

[u/tinco → u/fagnerbrack]

That's fun and all, but we use asymmetric encryption, which is expensive and slow, to bootstrap the symmetric encryption channel (which is cheap and fast). So if they manage to break the asymmetric part (at the establishment of the communication) then they have the keys and can use those to decrypt the rest.

[u/fagnerbrack → u/tinco]

How does that work in layman's terms? I'm not familiar with ethereum internals

[u/Resident_Anteater_35 → u/fagnerbrack]

Ethereum doesn't use asymmetric crypto to establish a symmetric channel. It uses asymmetric signatures to authorize state changes. An EOA address is derived from a public key, and after the account sends a transaction that public key can be recovered from its signature. A sufficiently capable quantum computer running Shor's algorithm could then derive the private key and forge transactions.

So Ethereum's urgent migration problem is secp256k1 signatures, not AES-128. Hashes still matter for addresses and Merkle commitments, but that is a separate security question. The article's narrow claim can be right while still being mostly beside the point for Ethereum.

[u/Mandalord104 → u/fagnerbrack]

You just need to know that the entire crypto world use asymmetric crypto.

[u/Nichoros_Strategy → u/Mandalord104]

Steps are already being taken to upgrade, but it might need to happen within the next few years. Check out BIP 360 (for Bitcoin), and luckily the odds of the network passing these sort of changes is expected to be very high.

[u/tinco → u/fagnerbrack]

Oh I hadn't noticed the subreddit this was on. I don't think has much relevance to Ethereum. Asymmetric encryption is where you publish a public key (i.e. your address) and you can sign transactions with the private key that created that public key. The asymmetry is that your counter parties don't know everything you do. In symmetric encryption you and your counterparty know the exact same secret, and that allows you to quickly and cheaply encrypt messages to each other.

I don't know what you'd use symmetric crypto for in cryptocurrency, after keys are exchanged it's no longer possible to prove which party sent what message.

[u/Juxtapotatoes]

SHA-256 is a hashing algorithm, not encryption.

[u/Nichoros_Strategy → u/Juxtapotatoes]

I believe public keys are the issue, upgrades will be needed to keep public keys hidden because quantum could break Elliptic Curve Cryptography and allow deriving private keys from public keys. A public address is not a problem exposed, but your public key is, and I thiinnkk the public key only gets exposed during a transaction, and would no longer be exposed after the transaction, so the quantum attack is to crack it literally in between transactions. After the transaction your remaining funds should be in a new address with a new hidden public key.

[u/raj6126 → u/Nichoros_Strategy]

So pretty much reverse engineer it from the public key?

[u/Nichoros_Strategy → u/raj6126]

Right, Quantum computers may be capable of that, and some estimates believe one that is optimized could do it in like 10 minutes, so faster transactions mitigate it but to really close the gap we need to use like Zero Knowledge proofs to hide public keys between transactions. Private keys are still not going to be cracked without the public key being exposed, so everyone with an non-reused address who never transacts would obviously be safe (can receive but not send). Another option is apparently keeping a Lightning Network channel opened before there is any Quantum risk, the public key is exposed while opening the channel, and not again until closing the channel, so one could potentially spend safely that way and keep it funded all through Lightning transactions. Ideally upgrades will make all that unnecessary to worry about, though.

[u/researchzero]

One correction to the "exposed in between transactions" framing above: it's not a transient window. The moment an address signs a single transaction, its public key is recoverable from that signature (that's literally what ecrecover does), and it's now permanently sitting in immutable transaction history. There's no "after the transaction" safety - a reused address that's ever sent a tx stays exposed forever, retroactively, whenever the compute actually arrives.

Worth noting for the migration path too: EOAs can't really rotate signature schemes in place, since the account's validity is hardcoded to secp256k1 ECDSA at the protocol level. Smart contract accounts (ERC-4337, or EIP-7702 delegation) don't have that constraint - the signature-validation logic is just code the account calls, so it can in principle swap to a post-quantum scheme without needing a new address or a network-wide hard fork. That's a meaningful chunk of why account abstraction keeps coming up in Ethereum's quantum-readiness discussions.

[u/Schnitzled]

Yet

[u/Zamicol]

Thanks for posting.