Compare AES-128, AES-192 and AES-256 by round count, effective security bits and brute-force time, with a Grover option.
AES has no practical shortcut attack, so its strength equals its key length and an exhaustive search needs half the key space on average. Grover's algorithm gives a quantum attacker a quadratic speed-up, which is equivalent to halving the key length — AES-256 drops to a 128-bit effective strength, AES-128 to 64 bits. Choosing AES-256 over AES-128 costs about 40% more rounds but is the only symmetric choice that still holds a 128-bit margin against a future quantum attacker, which is why CNSA 2.0 mandates it.
AES Key Strength
effective strength = key size (halved to key/2 under Grover); average brute-force time = 2^(strength − 1) ÷ trials per second.
Round schedule (FIPS 197)
AES rounds = 10 for a 128-bit key, 12 for 192-bit, 14 for 256-bit.
effective strength = key size (halved to key/2 under Grover); average brute-force time = 2^(strength − 1) ÷ trials per second. AES has no practical shortcut attack, so its strength equals its key length and an exhaustive search needs half the key space on average. Grover's algorithm gives a quantum attacker a quadratic speed-up, which is equivalent to halving the key length — AES-256 drops to a 128-bit effective strength, AES-128 to 64 bits.
Choosing AES-256 over AES-128 costs about 40% more rounds but is the only symmetric choice that still holds a 128-bit margin against a future quantum attacker, which is why CNSA 2.0 mandates it.
This calculator takes 3 inputs: AES key size, Attacker key trials per second, Assume a Grover-capable quantum attacker. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Yes against classical attackers — 2^127 average trials is far beyond any conceivable budget. It is not future-proof, because Grover's algorithm reduces it to a 64-bit effective strength, so new systems that must stay confidential past 2035 should use AES-256.