Skip to content
—
QuantascanAlpha

Grover's algorithm and hash functions

Why the quantum threat to hash functions is real but manageable — and why doubling the hash size is enough.

5 min readUpdated 2026-06-20

On this page▾

When people worry about quantum computers and cryptography, two algorithms come up: Shor's and Grover's. Shor's is the catastrophe. Grover's is the one that sounds scary but is actually quite manageable — and understanding why is key to understanding QRL's design.

What Grover's algorithm does

Grover's algorithm speeds up unstructured search — finding a needle in a haystack when you have no clever shortcut, only the option to try candidates. Classically, searching N possibilities takes about N tries. Grover's algorithm does it in about √N tries on a quantum computer.

For cryptography, the relevant "search" is attacking a hash function: finding an input that produces a given output (a preimage), or two inputs that collide.

Why a square root isn't a catastrophe

A square-root speed-up sounds dramatic until you look at the numbers. A 256-bit hash like SHA-256 has roughly 2^256 possible outputs. Grover's algorithm reduces a brute-force attack from about:

  • 2^256 classical effort, to
  • about 2^128 quantum effort.

2^128 is still an unimaginably large number — far beyond what any computer, quantum or otherwise, could ever exhaust. Compare that to Shor's algorithm against ECDSA, which turns the attack from "impossible" into "fast." That's the difference between a dent and a break.

The fix is trivial: use bigger hashes

Even better, the defence against Grover's is almost free. If a square root halves your effective security (256 bits → 128 bits of quantum security), you simply double the output size. A 512-bit hash gives you back a 2^256 quantum security margin.

No exotic new mathematics is required — just larger, well-understood hash functions. This is why post-quantum cryptographers treat hashing as essentially solved against quantum attack.

What this means for QRL

QRL's quantum-resistance story is mostly about signatures, because that's where Shor's algorithm bites. But hash functions appear all over a blockchain — in addresses, in block linking, and especially inside XMSS, which is built from hash functions. QRL chooses hash sizes generously, with the Grover speed-up accounted for, so the hashing layer keeps a comfortable margin.

The takeaway: don't lose sleep over hashes. The quantum threat that matters is to signatures, which is exactly the part QRL replaces.

Where to go next

FAQ about Grover's algorithm and hash functions

Common questions about this page
Does Grover's algorithm break SHA-256?
No. Grover's algorithm only provides a square-root speed-up, turning roughly 2^256 work into 2^128 — still astronomically large. And doubling the hash output (256 → 512 bits) restores the original security margin entirely.
Why are hash functions more quantum-resistant than signatures?
Signatures like ECDSA rely on number-theoretic problems that Shor's algorithm solves efficiently — a catastrophic break. Hash functions only face Grover's quadratic speed-up, which is easily offset by using larger outputs.
How does QRL use this?
QRL's quantum-resistance is mainly about signatures, but hash functions are everywhere in a blockchain. QRL chooses hash sizes with the Grover speed-up in mind, keeping a comfortable security margin.
← Back to Learn