AES-128 is considered weak against quantum computers because Grover's algorithm effectively halves its key length to unacceptable 64 bits.

XTS-AES-128 as described in IEEE 1619-2007 doubles key length to 256 bits by using distinct 128-bit keys for block and tweak encryption, which is sometimes remarked as unnecessary change to the original XEX construction.


Grover's algorithm applied to XTS-AES-128 would attack the double-length 256 bit key, reducing it to 128 bits. Does it mean that the decision to use two keys for XTS-AES-128 made it reasonably resistant against quantum computers?


Your Answer


Browse other questions tagged or ask your own question.