Does Grover's algorithm's key-length halving apply equally to all symmetric ciphers, or do some resist it better?

Your question asks whether Grover's algorithm's quantum speedup (which halves classical key lengths for symmetric ciphers) applies uniformly across all cipher designs, or whether some have structural defenses.

The provided preprints don't directly address this question. They explore Grover's algorithm itself—its implementation, optimization, and application to other hard problems like lattice search—but none analyze how specific symmetric cipher designs (like AES, ChaCha, or other constructions) might resist the key-length halving effect differently.

What *would* answer your question is research on quantum attacks against particular cipher architectures: whether the block size, S-box structure, key scheduling, or diffusion layers of different ciphers create asymmetries in how Grover's search applies. The closest relevant context is [AG-2024.07-2243], which presents quantum algorithms for finding truncated differentials in symmetric ciphers—a cryptanalysis tool that *could* potentially be combined with Grover to break specific ciphers more efficiently than generic key search—but it doesn't compare cipher-by-cipher resistance.

To properly answer whether, say, AES resists Grover better than a simpler Feistel network, you'd need papers explicitly modeling quantum oracle complexity for different cipher internals, which aren't in this collection.