The whole promise is that reversible computation is theoretically free (in quantum information theory) , quantum computer can exploit it by using quantum superposition to brute force 256bit key (and larger) in a single computation cycle.
There’s a massive fundamental flaw in the reasoning behind this.
It’s the second law of thermodynamics - entropy always increases. While computation is free, reversal of entropy isn’t. What we’re being promised is a 21st century version of perpetual motion machine.
Additional explanation:
Think about private key as low entropy, and public key as high entropy. Owner of the private key has cheat code in the form of missing information which allows reversing the entropy of public key.
However in order to break the cryptography you have to reverse public key back into private key without having access to it. The regualr way is to search for flaws in the cryptography scheme that allow reasoning about missing information and consecutively - private key recovery.
But if you do a brute force attack you are 100% forced to pay full thermodynamical price of reversing the entropy. And 2^256 is way, way more than you could ever afford. Even Planck scale values multiplied by that number grow into universe size and beyond.
In summary, quantum computing can skip time component of brute forcing a key, but it can’t skip the energy costs. So it will never happen.
With regards to extracting the private key from the public key, to my knowledge there is shors algorithm that runs in polynomial time on a quantum computer that solves integer factorisation.
Solve integer factorisation in P and you break RSA in P. I believe there are similar P algorithms that run on quantum computers for the discrete logarithm problem and elliptic curve discrete logarithm problem.
In this sense, if you scale quantum computers resources enough you break modern asymmetric cryptography.
With regards to breaking AES: Quantum computers halve the security. So 256 bit security goes to 128 bits. Still secure.
AES 128 goes to 64 bits of security. Hmmm maybe not secure anymore. Have a read of post quantum cryptography and shors algorithm to see what im on about
EDIT: added important details
Edit 2: so so many typos
I’m not claiming you can’t do it faster. I’m claiming it’s impossible to skip the related fundamental energy requirements.
Energy requirements scale exponentially on a polynomial time algorithm? That doesnt make sense. I admit however I have only studied quantum computers in relation to what they can do, not how. But I hope what I am saying makes sense.
I’m not an expert in quantum computing. The whole point of this thought experiment is to skip all all the mechanics and make an argument based on general fundamental thermodynamic limitations.
Not a physisct, so I dont known how much scaling of quantum computers can actually be done