pqcstatus
Algorithm

AES: quantum risk, deadlines and replacements

Weakened by quantum

Standard symmetric cipher. Grover's algorithm only halves effective strength: AES-256 remains quantum-safe.

At a glance

Quantum riskWeakened by quantum
Used forSymmetric encryption
Post-quantum algorithmNo

Variants and security strength

VariantClassical security (bits)
AES-128128
AES-192192
AES-256256

Positions and deadlines by authority

AuthorityPositionEffectiveScopeDetails
NISTAcceptablein forceall variants
NSA (CNSA 2.0)Recommendedin forceAES-256CNSA 2.0 requires AES-256.

Sources

  1. FIPS 197 — Advanced Encryption Standard (AES) · NIST
  2. CNSA 2.0 Algorithms (Cybersecurity Advisory) · NSA (guidance)

Catalog version 2026-09-28. Every position links to its primary source; draft documents are labelled as such.

Frequently Asked Questions

Is AES quantum-safe?

Partially. Grover’s algorithm reduces its effective security; larger variants remain adequate, while broken legacy variants must be retired now.