Symmetric Algorithms Should Be Part of a Quantum Migration Strategy

Often, narratives and plans regarding quantum migration focus on asymmetric cryptography. Algorithms like RSA and ECDSA will be completely broken by Shor's algorithm, making a swap to post-quantum alternatives imperative.

Symmetric algorithms like AES and SHA don't face the same level of quantum threat as their asymmetric counterparts. However, ignoring them during quantum migration can leave sensitive data at risk.

Shor's vs. Grover's Algorithms

Companies are developing quantum migration plans in response to Shor's algorithm. Once cryptographically relevant quantum computers (CRQCs) become available, they'll be able to solve the factoring and discrete logarithm problems with polynomial complexity. This speedup completely breaks the classical public key cryptography built using these "hard" problems.

The other cryptographically relevant quantum algorithm is Grover's algorithm. This algorithm applies to symmetric encryption algorithms, such as AES, and hash functions. However, unlike Shor's algorithm, Grover's algorithm doesn't completely break these algorithms. Instead, it halves their effective key length, which is why most quantum migration plans ignore these algorithms.

When Grover's Algorithm Matters

Ideally, Grover's algorithm won't break implementations of symmetric cryptography and hash functions. In many cases, halving the effective key length will leave an algorithm with enough security that it still can't be broken by current means. For example, AES-256 will have 128 bits of effective security, which is still plenty.

However, not all implementations of symmetric encryption and hash algorithms use adequate key lengths. AES offers 128 and 192-bit variants, which will be rendered insecure by Grover's algorithm. SHA variants with digest lengths less than 384 bits are similarly insecure once CRQCs become available.

Managing the Quantum Threat to Symmetric Cryptography

In theory, a quantum migration plan only needs to cover asymmetric cryptography because that's all that is absolutely broken. With Shor's algorithm, algorithms like RSA and ECDSA are no longer trustworthy after Q-Day and vulnerable to harvest now, decrypt later attacks today.

While Grover's algorithm is less dangerous for symmetric cryptography, it still poses a threat. AES-128, AES-192, and SHA with digest lengths under 384 bits need to be migrated as well.

The first step toward performing this migration is identifying where potentially vulnerable cryptography exists within the organization. Building a cryptographic bill of materials (CBOM) allows the organization to track where it uses cryptography, what implementations are vulnerable, and the current status of quantum migration.