# Grover's algorithm and hash functions

> Why the quantum threat to hash functions is real but manageable — and why doubling the hash size is enough.

When people worry about quantum computers and cryptography, two algorithms come up: [Shor's](/learn/how-quantum-computers-break-crypto) and **Grover's**. Shor's is the catastrophe. Grover's is the one that sounds scary but is actually quite manageable — and understanding why is key to understanding QRL's design.

## What Grover's algorithm does

Grover's algorithm speeds up **unstructured search** — finding a needle in a haystack when you have no clever shortcut, only the option to try candidates. Classically, searching `N` possibilities takes about `N` tries. Grover's algorithm does it in about **√N** tries on a quantum computer.

For cryptography, the relevant "search" is attacking a **[hash function](/learn/glossary#hash-function)**: finding an input that produces a given output (a preimage), or two inputs that collide.

## Why a square root isn't a catastrophe

A square-root speed-up sounds dramatic until you look at the numbers. A 256-bit hash like SHA-256 has roughly `2^256` possible outputs. Grover's algorithm reduces a brute-force attack from about:

- `2^256` classical effort, to
- about `2^128` quantum effort.

`2^128` is still an unimaginably large number — far beyond what any computer, quantum or otherwise, could ever exhaust. Compare that to Shor's algorithm against ECDSA, which turns the attack from "impossible" into "fast." That's the difference between a *dent* and a *break*.

## The fix is trivial: use bigger hashes

Even better, the defence against Grover's is almost free. If a square root halves your effective security (256 bits → 128 bits of quantum security), you simply **double the output size**. A 512-bit hash gives you back a `2^256` quantum security margin.

No exotic new mathematics is required — just larger, well-understood hash functions. This is why post-quantum cryptographers treat hashing as essentially solved against quantum attack.

## What this means for QRL

QRL's quantum-resistance story is mostly about **signatures**, because that's where Shor's algorithm bites. But hash functions appear all over a blockchain — in addresses, in block linking, and especially inside [XMSS](/learn/xmss-explained), which is *built* from hash functions. QRL chooses hash sizes generously, with the Grover speed-up accounted for, so the hashing layer keeps a comfortable margin.

The takeaway: don't lose sleep over hashes. The quantum threat that matters is to **signatures**, which is exactly the part QRL replaces.

## Where to go next

- [How quantum computers break cryptography](/learn/how-quantum-computers-break-crypto) — Shor's algorithm, the real danger.
- [Hash-based signatures](/learn/hash-based-signatures) — turning hashes into a signature scheme.
- [NIST post-quantum standards](/learn/nist-post-quantum-standards) — the standardised defences.