Post-Quantum security of Pseudo-Random Functions I am wondering what is the exact post-quantum security of a PRF. I know that for most symmetric mechanisms, it is assumed it is sufficient to double the key size, but I am looking for a more precise analysis in the case of Pseudo-Random Functions (like $2^{(n/2)}$ operations with Grover algorithm for the preimage).

To clarify, I am searching for (1) generic attacks (not on any specific PRF) (2) for an attacker that only has classical access to the PRF.
The best generic classical attack on a PRF is a generic preimage search for the unknown key.  Given an input $x$ and an output $f_k(x)$ for uniform random $k \in \{0,1\}^n$, the best known algorithm costs about $2^n$ trial evaluations of $f$ to find $k$.  Given multiple targets $(f_{k_1}(x), f_{k_2}(x), \dots, f_{k_t}(x))$, it costs about $2^n\!/t$ trial evaluations of $f$ to find at least one of the $k_i$, using a rainbow table search if it is done on a machine parallelized at least $t^2$ ways.

The best generic quantum preimage search costs about $\sqrt{2^n} = 2^{n/2}$ trial evaluations of quantum superpositions of $k \mapsto f_k(x)$, using Grover's algorithm.  Grover's algorithm doesn't parallelize well: if parallelized $p$ ways, it returns an answer in time $\sqrt{2^n\!/p} = 2^{n/2} / \sqrt p$ and therefore costs $2^{n/2} \cdot \sqrt p$ to run a machine $p$ times larger for $1/\!\sqrt p$ times as long.  In the single-target setting, Grover's algorithm is asymptotically optimal.  The best known batch advantage for a multi-target search (not known to be optimal but dramatic improvements seem unlikely) is modest, reducing the cost by a mere factor of $\sqrt[4]{t}$ to find the first of $t$ targets.



There is also a fantasy threat model where not only does the adversary have a quantum computer, but where you for some inexplicable reason compute quantum superpositions of $x \mapsto f_k(x)$ on behalf of the adversary.

While I don't know of any generic attacks, many particular cryptosystems are breakable using Simon's algorithm (random example) in this doubly unrealistic threat model where the adversary has a quantum computer, you have a quantum computer, I have a quantum computer, and everyone and their dog has a quantum computer, and you blithely compute secret functions on quantum superpositions of inputs on request from the adversary.

Solution: When strange men in dark coats ask you on the street for quantum superpositions of your secret functions, RUN AWAY!

More seriously, if you are tempted to evaluate secret functions on a quantum computer yourself, on behalf of anyone including puppies and unicorns and not just strange men in dark coats, take a moment to do a literature search to reconsider your life choices.