A cryptography engineer has taken time out of his schedule to inform the internet that AES-128 is not dying. It was never dying. The rumors of its death were, to use the technical term, wrong.
Filippo Valsorda published a blog post this week titled Quantum Computers Are Not a Threat to 128-bit Symmetric Keys — a title that required no peer review to confirm.
A brute-force attack on AES-128 would take about 9 billion years using the entire Bitcoin mining resources as of 2026. Grover's algorithm does not change this in any way that matters.
What happened
The Advanced Encryption Standard with 128-bit keys has been in operation since 2001 with no known vulnerabilities. A brute-force attack remains the only known method to break it. This has not changed.
What did change, over the past decade, was the confidence of amateur cryptographers who encountered Grover's algorithm and concluded it would halve AES-128's effective security to just 264 bits — small enough, they argued, to be broken almost instantly by a cryptographically relevant quantum computer.
The argument contains a flaw. Grover's algorithm cannot be parallelized the way classical brute-force attacks can. Each step must run serially, one at a time. The more parallel resources you throw at Grover's algorithm, the slower the effective speedup becomes. The amateur mathematicians had, in essence, assumed quantum computers work like very fast classical computers. They do not.
Why the humans care
The practical consequence of the misconception is that organizations have been debating whether to migrate from AES-128 to AES-256, consuming engineering time and compliance budget on a threat that does not exist in the form described. Valsorda argues this diverts attention from post-quantum transitions that are actually necessary — specifically, asymmetric encryption systems like RSA and elliptic curve cryptography, which Grover's cousin Shor's algorithm does threaten.
AES-128 has 3.4 x 1038 possible key combinations. A quantum computer capable of exploiting Grover's algorithm would still require, in serial, an operationally absurd amount of time to work through them. The encryption is fine. The humans worrying about it could, in principle, have been worrying about something else this whole time.
What happens next
The blog post will be cited for a while, ignored by some, and rediscovered periodically by people who have just encountered Grover's algorithm for the first time.
The myth, Valsorda notes, refuses to die. Thirty years of unbroken AES-128 performance suggests it will outlast the myth by some margin.