Is GCM mode of authenticated encryption quantum secure? Regarding post-quantum symmetric cryptography, it has been recommended to move to AES-256 or similar ciphers with 256-bit keys. How is authenticated encryption affected? Is AES-256-GCM considered quantum-safe? what are the other alternatives for post-quantum authenticated encryption?
Is AES-256-GCM considered quantum-safe?


For most common scenarios, yes.

Actually, it depends on your attack model.  If your attack model is that the attacker is allowed to perform entangled queries on your GCM implementation, and return entangled responses, then, no, GCM is known not to be secure against this model; the attacker can use Grover's algorithm on the decryption Oracle to find a second valid ciphertext/tag with a previous seen nonce with $O(2^{64})$ work.

On the other hand, the attack model is rarely appropriate.  Entanglement is quite delicate, and to make this attack model work, the decryption oracle would need to be implemented using quantum error correction.  Typically, implementations don't help out the adversary to that extent, and hence it would need to be implemented as a part of the quantum computer (so that the adversary can implement quantum error correction within the oracle).  About the only way this would be practical would be if you were attacking a white-box GCM implementation (so you couldn't trivially examine the implementation and extract the key).

In the standard scenario, where the attacker is allowed to make conventional queries to the oracle, and get the standard response, the standard proof of GCM applies; unless they can distinguish AES from a random permutation, they cannot generate a valid ciphertext/tag pair with nontrivial probability; using a 256 bit AES key means that Grover's algorithm would take $O(2^{128})$ time for this, which is generally considered infeasible.