What security do Cryptographic Sponges offer against generic quantum attacks? In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides:


Collision resistance up to $2^{256}$ operations
Preimage resistance up to $2^{256}$ operations
Second preimage resistance up to $2^{256}$ operations


In general however, using quantum computing, specifically Grover's Algorithm, hash functions can be attacked more efficiently. Daniel J. Bernstein wrote about quantum attacks against all the second round SHA-3 candidates. However, in that paper, all the attacks against Keccak variants are against truncated hashes with an internal capacity of twice the hash length, for example Keccak[r=1152,c=448] with 224 bits of output.

My question is, if the full 512 bit hash output length of Keccak[r=1088,c=512] is used, does this provide security up to $2^{256}$ operations against quantum attackers using Grover's algorithm, or is security limited to half of the preimage strength, that is, only $2^{128}$ operations?
Unless Keccak has structural weaknesses that I am not aware of, the answer is surprisingly neither 128 nor 256!
Gilles Brassard, Peter Høyer, and Alain Tapp describe a sort of quantum birthday attack in their paper &quot;Quantum Cryptanalysis of Hash and Claw-Free Functions&quot; that effectively works by creating a table of size $\sqrt[3]{2^b}$ (versus the $\sqrt{2^b}$ for the classic birthday attack) and then utilizes Grover's algorithm to find a collision.
While the classic birthday attack thus requires ${\mathcal O}\left(\sqrt{2^b}\right)$ time and memory, the quantum birthday attack only requires ${\mathcal O}\left(\sqrt[3]{2^b}\right)$ time and memory.
This means that to provide a $b$ bit security level against quantum adversaries, a hash function must provide at least a $3b$ bit output.
In your case of 512-bit Keccak, your security level would be $170\frac{2}{3}$.