Shor vs Grover: what breaks and what only weakens
Two quantum algorithms define the whole threat. Shor's breaks public-key cryptography outright; Grover's only weakens symmetric crypto, and is answered by using longer keys.
Free video lesson · 1:24
Can Quantum Computers Break Encryption?
Quantum Computing & Encryption for Beginners
Watch on YouTube (opens in a new tab) · Music: “Thinking Music” by Kevin MacLeod. Creative Commons Attribution 4.0.
A sufficiently capable quantum computer threatens some encryption methods, not all of them.
Read the video transcript
A powerful enough quantum computer could break some widely used encryption methods. It would not break all encryption. No publicly demonstrated machine can carry out those large attacks today.
Encryption uses mathematics to keep a message private. Some systems use a public key that anyone can see, and a matching private key that must stay secret. Their safety depends on making that private key hard to find.
For some common methods, a sufficiently capable quantum computer would make finding the private key much easier. That could let an attacker read information protected using those methods.
Other methods face a different kind of attack. AES-256 is a widely used way to scramble data with a shared secret key. Known quantum attacks do not make correctly used AES-256 practical to break.
So the question is which protection a system uses. Some parts need replacements designed for quantum attacks. Saying quantum computers break encryption hides that important difference.
Why worry before the machine exists? Watch What Is Harvest Now, Decrypt Later? For the shared-key example, watch Is AES-256 Quantum Safe?
The quantum threat to cryptography comes down to two algorithms with very different consequences. Confusing them leads to bad decisions: either panic about AES, or complacency about RSA. Keeping them straight tells you exactly where to spend effort.
Shor's algorithm: the structural break
Peter Shor's 1994 algorithm efficiently solves integer factorization and the discrete logarithm problem on a quantum computer. Those are the precise problems RSA, Diffie-Hellman, and elliptic-curve cryptography rely on being hard. A cryptographically relevant quantum computer running Shor's algorithm can therefore derive a private key from its public key, forging signatures and opening key exchanges. This is not a weakening you can patch with bigger keys: doubling an RSA key size is trivially absorbed by the algorithm's speedup, so the entire family has to be replaced.
Grover's algorithm: the quadratic dent
Lov Grover's 1996 algorithm speeds up unstructured search, letting a quantum computer find a secret among N possibilities in roughly the square root of N steps instead of N. Applied to a symmetric key, that roughly halves the effective security level: a 128-bit key offers something like 64 bits of quantum resistance. Crucially, this is a fixable weakening: move from AES-128 to AES-256 and you are comfortably back above any practical threat, because Grover's quadratic speedup is far gentler than Shor's exponential one. Hash functions are similarly addressed with longer outputs.
The practical takeaway
Symmetric crypto and hashing: keep them, size them up (AES-256, SHA-384/512). Public-key crypto: replace it with post-quantum algorithms. Effort and urgency belong overwhelmingly on the public-key side. That is where the structural break is.
Why this shapes the migration order
Because Shor's break is total, every RSA and elliptic-curve deployment is in scope. Because harvest-now-decrypt-later applies to confidentiality, key exchange protecting long-lived data comes first, with signatures following. And because Grover only dents symmetric crypto, you do not need to rip out AES, a common and costly misconception. The threat is precise, and so is the response.
"Quantum breaks all encryption"
It does not. It breaks the public-key algorithms that establish keys and sign data. The symmetric encryption doing the actual bulk work is only weakened, and is fixed by using larger keys. Treating AES as broken wastes effort that belongs on the key exchange and signatures.