Standard symmetric cipher. Grover's algorithm only halves effective strength: AES-256 remains quantum-safe.
At a glance
| Quantum risk | Weakened by quantum |
|---|
| Used for | Symmetric encryption |
|---|
| Post-quantum algorithm | No |
|---|
Variants and security strength
| Variant | Classical security (bits) |
|---|
| AES-128 | 128 |
| AES-192 | 192 |
| AES-256 | 256 |
Positions and deadlines by authority
| Authority | Position | Effective | Scope | Details |
|---|
| NIST | Acceptable | in force | all variants | |
| NSA (CNSA 2.0) | Recommended | in force | AES-256 | CNSA 2.0 requires AES-256. |
Sources
- FIPS 197 — Advanced Encryption Standard (AES) · NIST
- CNSA 2.0 Algorithms (Cybersecurity Advisory) · NSA (guidance)
Catalog version 2026-09-28. Every position links to its primary source; draft documents are labelled as such.