Grover's algorithm: the honest cost of key search

Algorithm preset

Logical qubits

Toffoli gate count

T-depth (serial layers)

Physical error rate

Code cycle time

Error budget

Physical qubits (total)

Estimated runtime

Code distance

Surface-code rounds of redundancy

Data-block physical qubits

2 × logical × d²

T-gate count

4 T per Toffoli

Physical per logical

Error-correction overhead factor

Highlighted share: magic-state factories (conservative bound shown).

Grover's algorithm: why symmetric crypto mostly survives

Grover's algorithm searches an unstructured space of N items in √N steps. Pointed at a 128-bit AES key, that means about (π/4)·2⁶⁴ ≈ 1.4×10¹⁹ sequential oracle calls - each of which is itself a full AES circuit of thousands of Toffoli gates. The calculator above is loaded with that honest accounting.

The result is the point: even at a microsecond per surface-code cycle, a serial Grover attack on AES-128 runs for longer than the age of the universe. Parallelizing Grover helps far less than people expect - k parallel machines give only √k speedup - so 2⁶⁴ sequential iterations is a fundamentally hard floor.

This is why NIST's post-quantum guidance for symmetric crypto is simply: use AES-256. Grover's quadratic gain turns a 256-bit key into an effective 128-bit one - still beyond reach.
Contrast with RSA/ECC, where Shor gives an exponential speedup. Asymmetric crypto breaks; symmetric crypto shrinks.
Grover-style amplitude amplification does have practical uses - combinatorial optimization and Monte-Carlo speedups - where the oracle is small and the quadratic gain is still worth having.

Sources: Grover, STOC 1996 · Grassl, Langenberg, Roetteler, Steinwandt, PQCrypto 2016 (AES oracle costs), arXiv:1512.04965 · NIST SP 800-131A key-management guidance.