AES, hash-based, and code-based cryptography: what actually survives the quantum era?

Is AES quantum resistant? Discover how quantum computing affects AES, hash functions and public-key cryptography, and which algorithms remain secure in the quantum era.

Quantum computing has sparked a fundamental shift in how organizations think about cybersecurity. But despite the focus on quantum threats, there is still considerable confusion about which cryptographic technologies are at risk.

The reality is that not all cryptography is affected in the same way. Some algorithms will need to be replaced entirely, while others are already secure and will continue to form the foundation of modern cybersecurity for years to come.

Three cryptographic families are particularly important when discussing the transition to the quantum era:

• Advanced Encryption Standard (AES) is the world’s most widely used symmetric encryption algorithm, protecting everything from cloud data and VPNs to financial transactions and wireless communications. Rather than being broken by quantum computing, AES is expected to remain secure.
• Hash-based cryptography uses cryptographic hash functions to create secure digital signatures. While hash functions are also affected by quantum algorithms, they remain highly resilient and have become an important part of Post-Quantum Cryptography (PQC), with NIST standardising Stateless Hash-Based Digital Signature Algorithm (SLH-DSA) in 2024.
• Code-based cryptography secures information using error-correcting codes rather than mathematical problems such as integer factorization or elliptic curves. It has been researched for decades and remains one of our strongest defenses against quantum attacks.

Organizations planning their transition to PQC must understand the differences between these technologies. While public-key algorithms such as RSA and Elliptic Curve Cryptography (ECC) need replacing, AES, hash functions, and newer quantum-resistant algorithms each have an important role to play in securing digital infrastructure long into the future.

This raises an important question: is AES quantum resistant, and how does it compare with other cryptographic approaches designed for the quantum era?

Does quantum computing break all encryption?

Is AES quantum resistant? The answer is yes, but it’s part of a much bigger picture.

One of the biggest misconceptions about quantum computing is that it will break every form of cryptography overnight. Different cryptographic algorithms are affected in different ways. Some require complete replacement, while others remain secure with only minor adjustments.

Rather than replacing every cryptographic algorithm in use today, the goal is to identify which technologies remain fit for purpose, and which require migration.

This distinction is reflected in the first PQC standards published by the National Institute of Standards and Technology (NIST) in August 2024. These standards focus on replacing vulnerable public-key cryptography, while symmetric encryption algorithms such as AES and cryptographic hash functions continue to play a critical role in modern security architectures.

Does quantum computing break every type of cryptography?

The short answer is no.

Today’s digital infrastructure relies on two broad cryptography categories:

• Symmetric cryptography, where the same secret key encrypts and decrypts data
• Public-key cryptography, where separate public and private keys enable secure communication and digital signatures

These technologies solve different problems, and quantum computers affect them differently.

Algorithms such as RSA and Elliptic Curve Cryptography (ECC), which underpin much of today’s Public Key Infrastructure (PKI), are vulnerable to Shor’s algorithm. A sufficiently powerful quantum computer could solve the mathematical problems that make these algorithms secure, rendering them ineffective.

Symmetric encryption, however, is a different story.

Algorithms like AES are, in theory, affected by Grover’s algorithm, which offers a quadratic speed-up for brute-force key searches rather than completely breaking the underlying mathematics. As a result, AES remains viable in a post-quantum world, particularly when larger key sizes (for example, AES-256) are used.

Is AES quantum resistant?

This is perhaps the most common question organizations ask when preparing for PQC migration.

The good news is that AES is considered quantum resistant against known attacks. However, that conclusion comes with some important caveats.

How AES works

The Advanced Encryption Standard (AES) is a symmetric block cipher used to protect data at rest and in transit. It underpins technologies such as VPNs, TLS sessions, encrypted storage, wireless networking, and cloud services.

Unlike RSA or ECC, AES does not rely on mathematical problems that can be solved using Shor’s algorithm.

Instead, the most effective known quantum attack on AES is Grover’s algorithm.

What does Grover’s algorithm do?

Grover’s algorithm reduces the number of operations required for a brute-force search from approximately 2ⁿ to 2ⁿᐟ².

This means that:

• AES-128 offers approximately 64 bits of security against an ideal quantum brute-force attack
• AES-256 offers approximately 128 bits of quantum security

Importantly, Grover’s algorithm does not break AES. It simply reduces the effectiveness of exhaustive key searches.

NIST also notes that practical implementation of Grover’s algorithm presents significant engineering challenges. Because the algorithm must operate largely in series rather than benefiting from the massive parallelization used in classical brute-force attacks, the real-world advantage is expected to be smaller than the theoretical quadratic speed-up.

Why organizations are adopting AES-256

Although NIST states that AES-128, AES-192 and AES-256 remain appropriate today, many organizations are adopting AES-256 to provide additional security margin against future quantum advances.

For organizations already planning broader cryptographic modernization, migrating to AES-256 is often a relatively straightforward way to strengthen symmetric encryption while preparing for wider PQC adoption.

Are hash functions still secure?

Hash functions in the context of quantum computing are frequently misunderstood.

Algorithms such as SHA-256 and SHA-512 are not encryption algorithms. Instead, they generate fixed-length fingerprints that verify integrity, authenticate software, and support digital signatures.

Hash functions are affected by Grover’s algorithm rather than Shor’s algorithm.

This means quantum computers can theoretically accelerate certain search problems, but they do not fundamentally break modern cryptographic hash functions.

Consequently, hash functions remain an important part of future cryptographic systems.

In fact, one of NIST’s first PQC standards, FIPS 205, specifies Stateless Hash-Based Digital Signature Standard (SLH-DSA), demonstrating that hash-based cryptography continues to play a valuable role in quantum-safe security.

Why public-key cryptography must change

While AES and hash functions remain largely intact, the same cannot be said for public-key cryptography.

Today’s internet depends heavily on RSA and ECC for:

• PKI (Public Key Infrastructure)
• Digital certificates
• TLS handshakes
• VPN authentication
• Code signing
• Secure email
• Identity management

A sufficiently capable quantum computer running Shor’s algorithm could solve the mathematical problems underlying these systems.

This is why NIST’s PQC program has focused almost entirely on replacing public-key algorithms rather than symmetric encryption.

In August 2024, NIST finalized its first three PQC standards:

• FIPS 203: ML-KEM for key establishment
• FIPS 204: ML-DSA for digital signatures
• FIPS 205: SLH-DSA for hash-based digital signatures

NIST has also selected HQC, a code-based key encapsulation mechanism, for future standardization to complement ML-KEM.

What about hash-based cryptography?

Hash-based cryptography has a long history but has become increasingly important as organizations prepare for PQC.

Unlike RSA or ECC, its security relies on the strength of cryptographic hash functions rather than integer factorization or elliptic curve mathematics.

SLH-DSA, standardized as FIPS 205, is particularly suited to applications where long-term signature security is essential, including:

• Firmware signing
• Software updates
• Secure boot
• Root of trust implementations

One advantage of hash-based signatures is that their security assumptions are relatively mature and well understood.

However, they also involve trade-offs.

Compared with lattice-based signatures such as ML-DSA, hash-based signatures typically produce larger signature sizes and slower signing operations, making them more appropriate for specific use cases than universal deployment.

Where does code-based cryptography fit?

Code-based cryptography is one of the oldest areas of PQC research.

Unlike lattice-based algorithms, it relies on the difficulty of decoding random linear error-correcting codes.

Perhaps the best-known example is Classic McEliece, which has been studied since the late 1970s without practical cryptanalytic breaks.

Although Classic McEliece was not selected among NIST’s first standards, NIST announced in 2025 that HQC, another code-based algorithm, had been selected for standardization as an additional key encapsulation mechanism. This provides algorithmic diversity alongside ML-KEM and helps strengthen the resilience of future cryptographic ecosystems.

The main drawback of many code-based systems is their extremely large public keys, which can make deployment challenging in constrained environments.

So, what survives the quantum era?

Perhaps the most important takeaway is that quantum migration is not about replacing every cryptographic primitive.

Instead, organizations should understand which technologies remain secure and which require replacement.

Building a quantum-safe cryptographic strategy

Most organizations will not replace cryptography overnight.

Instead, migration will involve:

• Discovering where cryptography is used
• Identifying quantum-vulnerable systems
• Prioritizing high-risk assets
• Introducing PQC alongside existing infrastructure
• Building cryptographic agility for future updates

NIST has repeatedly emphasized that organizations should begin planning migration now, rather than waiting for cryptographically relevant quantum computers to emerge. The publication of FIPS 203, FIPS 204, and FIPS 205 represents the beginning of implementation rather than the end of standardization.

For many organizations, the largest challenge will not be replacing AES. It will be modernizing PKI, certificates, digital signatures, and key establishment mechanisms across increasingly complex technology environments.

Why this matters for your organization

Preparing for PQC is not about replacing every cryptographic algorithm in use today. It is about understanding which technologies remain resilient, identifying where vulnerabilities exist, and developing a migration strategy that balances security, interoperability, and long-term flexibility.

For organizations asking whether AES is quantum resistant, the answer is reassuring. AES remains a trusted foundation of modern cybersecurity. The greater challenge lies in replacing vulnerable public-key cryptography and ensuring that PKI, digital signatures, and key establishment mechanisms are ready for the quantum era.

As standards continue to evolve, organizations that adopt a structured, standards-based approach to cryptographic modernization will be best placed to build resilient, quantum-safe systems for the future.

Why work with PQShield?

Preparing for the quantum era is about more than replacing vulnerable algorithms. It requires a clear understanding of what needs to change, what remains secure, and how to implement PQC without disrupting existing systems.

PQShield combines world-class cryptographic expertise with practical implementation experience to help organizations navigate this transition. With solutions spanning software, hardware and cloud environments, and active involvement in international PQC standards, PQShield helps enterprises modernize their cryptography with confidence.

Whether you’re assessing your cryptographic landscape, planning migration from RSA and ECC, or integrating standards-based PQC into your products and infrastructure, PQShield provides the expertise and technologies to support your journey towards quantum-safe security.

Book a call with one of our cryptography experts to discuss your PQC strategy and discover how PQShield can support your transition to quantum-safe security.

Frequently asked questions

Is AES quantum resistant?

Yes. AES is considered resistant to known quantum attacks. While Grover’s algorithm reduces the effectiveness of brute-force key searches, it does not fundamentally break AES in the way Shor’s algorithm threatens RSA and ECC.

Should organizations move to AES-256?

Many already are. Although NIST continues to support AES-128, AES-256 provides a larger security margin against potential future quantum attacks and aligns well with broader PQC migration strategies.

Does quantum computing break SHA-256?

No. Quantum computers may reduce the complexity of some search problems involving hash functions, but SHA-256 remains suitable for many applications. Hash functions continue to underpin several quantum-safe cryptographic schemes.

Why doesn’t Grover’s algorithm break AES?

Grover’s algorithm accelerates exhaustive key searches rather than exploiting weaknesses in AES itself. This provides a quadratic speed-up rather than the exponential advantage offered by Shor’s algorithm against public-key cryptography.

What replaces RSA and ECC?

NIST has standardized ML-KEM for key establishment and ML-DSA and SLH-DSA for digital signatures. These algorithms are designed to resist attacks from both classical and quantum computers.

Will organizations still use AES after PQC is adopted?

Absolutely. PQC primarily replaces vulnerable public-key algorithms. AES will continue to protect data encryption while new quantum-resistant algorithms replace RSA and ECC for key exchange and digital signatures.