No. NIST says current applications can keep using AES with 128, 192 or 256 bit keys. Quantum attacks hit public-key schemes like RSA and elliptic curves hard, while symmetric ciphers and hash functions are far less affected. The urgent work is replacing public-key cryptography, not re-keying everything.
Two different quantum attacks
Shor's algorithm breaks the math behind RSA, finite-field Diffie-Hellman and elliptic curves. That is why those schemes are being replaced.
Grover's algorithm speeds up brute-force search, but only modestly. NIST's post-quantum FAQ says that, because of limits on Grover's speedup, "it is quite likely that Grover's algorithm will provide little or no advantage in attacking AES." Its conclusion is that applications can continue to use AES with key sizes of 128, 192 or 256 bits.
What NIST IR 8547 says
The draft transition report states that all NIST-approved symmetric primitives providing at least 128 bits of classical security are believed to meet at least Category 1 of the five security categories used in the post-quantum process. It covers hash functions, XOFs, block ciphers, KDFs and DRBGs.
The same draft notes a small number of symmetric standards at the 112-bit security level, which will be disallowed in 2030, and says applications should move away from them. NIST's FAQ adds that anything with less than 112 bits of classical security should not be used.
What this means in practice
- Do not rush a project to replace AES-128 purely because of quantum computers.
- Do replace anything below 112 bits of strength, such as legacy short keys.
- Use AES-256 if your policy or contract asks for a larger margin, but understand that is a policy choice, not a quantum emergency.
- Focus on how the AES key is delivered. If it is wrapped or agreed with RSA or elliptic curves, that part is the exposure.
That last point is the one people miss. AES encrypting your data may be fine, while the RSA step that carried the AES key is the weak link in a harvest now, decrypt later scenario.
Hashes and signatures
Hash functions at 128 bits or more of classical strength are described by NIST as less vulnerable to known quantum attacks. A signature scheme is different: the hash inside it may be fine while the RSA or ECDSA signature around it is not.
One more practical point: check key length for old data stores. Some legacy systems still use short keys or old ciphers for historical reasons. Those are a larger and more immediate risk than any quantum attack, because they can be attacked with ordinary hardware today. A good quantum readiness project often turns up these older weaknesses along the way, which is a useful side benefit.
Quick check
Should we move all AES-128 data to AES-256 now?
NIST's FAQ says AES-128, 192 and 256 can all continue to be used. Prioritize public-key replacements first, and treat AES-256 as an optional margin.
If AES is fine, why worry about quantum computers at all?
Because the key agreement and signature steps around AES use public-key cryptography, and that is what quantum computers threaten.
Sources
Last reviewed: 19 October 2026.
