Quantum computers and iPhone encryption

AES-256 on your phone holds up well in current assessments. Public-key cryptography, used to connect and sync, is the part that needs replacing.

Headlines about quantum computers tend to say that all encryption is doomed. Cryptographers draw a sharper line. They separate symmetric encryption, used to lock your data, from public-key cryptography, used to set up connections and prove identity. Quantum computers threaten those two very differently.

Your files use symmetric encryption

Apple says that setting a passcode turns on Data Protection, which encrypts your iPhone data with 256-bit AES. Its Platform Security guide adds detail: each new file gets its own 256-bit key. On A14 through A18 and M1 or later chips, encryption uses AES-256 in XTS mode. On A9 through A13 chips, it uses AES-128 in XTS mode. Apple also notes that some apps may opt out of Data Protection.

AES uses the same key to lock and unlock. Breaking it without the key means searching through possible keys.

Grover’s algorithm and AES

A quantum method called Grover’s algorithm speeds up that search. Taken at face value, it would mean attacking a key of twice the length. That is where the common claim comes from that AES-256 acts like AES-128 against a quantum computer.

NIST says the practical effect is likely much smaller:

• Quantum hardware will likely cost more to build and run than ordinary hardware.
• The full speedup requires all steps to run one after another, and real attacks depend on running many machines in parallel.

NIST concludes that Grover’s algorithm will quite likely provide little or no advantage against AES, that AES-128 will remain secure for decades and that AES-192 and AES-256 should be safe for a very long time. That conclusion assumes nobody finds a new weakness in AES. The UK’s NCSC agrees that existing symmetric algorithms such as AES can continue to be used with suitable key sizes.

Public-key cryptography is the weak spot

Public-key systems rely on math problems such as factoring large numbers. The NCSC says these would be easy to solve on a large, general-purpose quantum computer. NIST estimates that a problem needing billions of years on a conventional computer could take such a machine days or hours.

Your phone uses this kind of cryptography when it creates secure connections to websites and services, and to verify that signed messages and accounts are authentic. So the risks would be:

• Recorded traffic could be decrypted later, by way of the key exchange. See harvest now, decrypt later.
• Signatures could be forged, by someone with such a machine, which matters for identity and trust.

Quantum computers that exist now are not a threat to public-key cryptography, according to the NCSC, and many challenges remain before a machine of the necessary scale can be built. NIST published its first post-quantum standards in 2024, and companies are moving to them. Apple’s iMessage has used its PQ3 protocol since 2024.

A photo on your phone

An attacker with a stolen, locked iPhone faces AES and Apple’s hardware, and current assessments do not suggest a quantum computer changes that much. Attacks on phones usually go around the encryption. Common routes include:

• Someone watching you type your passcode
• A phished Apple Account password
• A photo sent to another person, stored in a cloud account or saved by an app

None of these needs any exotic math. They are also what you can fix this week, by changing a passcode someone has seen and reviewing your account’s devices.

Be skeptical of quantum-proof claims

Marketing often uses “quantum-safe” loosely. When an app or service makes this claim, ask which part it covers. Using AES-256 for stored files does not by itself say anything about how the app’s keys are exchanged, backed up or recovered. A meaningful claim identifies the algorithms used for key exchange and signatures, ideally the NIST standards, and explains where they apply.