Beyond quadratic speedups in quantum attacks on symmetric schemes — mentioned by mswphd

Wed, 03 Jun 2026 18:27:00 GMT

It's worth noting that the above assumes that grover's is optimal for symmetric crypto. There are not that many quantum attacks against symmetric crypto that are better than grover's, so in some sense this is justified. But there are some attacks for particular constructions https://arxiv.org/pdf/2110.02836 So there is a risk that there are even more improved attacks that people aren't looking for due to the conventional wisdom that grover's is the best you can do for symmetric crypto. Hopefully this risk doesn't end up materializing.

Paper and discussion history. A mention is not an endorsement.

Beyond quadratic speedups in quantum attacks on symmetric schemes · HackerPapers discussions

Beyond quadratic speedups in quantum attacks on symmetric schemes — mentioned by mswphd