Does Grover's algorithm's key-length halving apply equally to all symmetric ciphers, or do some resist it better?

Your question asks about differential resistance to Grover attacks across cipher families—a nuanced cryptanalysis question that goes beyond the generic key-halving effect.

The provided preprints don't directly address this. Here's why:

Most sources treat Grover's algorithm as a generic quadratic speedup [AG-2024.03-1959] that applies uniformly to any unstructured search problem. In symmetric cryptography, this translates to the well-known rule: a 256-bit key becomes equivalent to 128 bits under quantum attack, regardless of cipher. The preprints focus on optimizing Grover itself—faster iterations [AG-2024.01-2095], handling non-power-of-2 search spaces [AG-2024.06-2077], or implementing it in constrained settings [AG-2024.03-1576]—not on *structural weaknesses* in specific ciphers.

However, one preprint hints at the deeper story. Quantum truncated differential and boomerang attacks [AG-2024.07-2243] explore cryptanalysis beyond brute force: they search for *structural properties* (differentials, distinguishers) that can break ciphers faster than generic key search. The abstract emphasizes that these quantum attacks "fully utilize the strengths of quantum computing" while "fully considering the impact of S-boxes and key scheduling"—meaning they *do* depend on cipher design. A cipher with weak S-boxes or poor diffusion might be more vulnerable to these tailored quantum attacks than to generic Grover search.

The practical answer: Grover's generic key-halving applies equally to all ciphers with standard design (AES, ChaCha, etc.). But ciphers with structural flaws may fall to *smarter* quantum attacks that exploit those flaws, whereas well-designed ciphers resist both.

The preprints don't quantify differential resistance across modern cipher families for Grover specifically.