Exercise 3: Why Shor's Algorithm Is More Devastating Than Grover's — Possible Solution
====================================================================

The key difference is WHAT KIND of mathematical problem each quantum
algorithm actually attacks, and how completely it attacks it.

GROVER'S ALGORITHM (threatens AES, Chapter 5):
AES's security rests on brute-force search being infeasible -- trying
every possible key in an unstructured search space. Grover's algorithm
provides a quadratic speedup for this kind of unstructured search
problem, which in practice means it roughly HALVES the effective key
strength (AES-128 becomes roughly as hard as a classical 2^64 search,
AES-256 becomes roughly as hard as a classical 2^128 search). This is
a real degradation, but it is a DEGRADATION, not a collapse -- AES-256
still comfortably remains secure against it, which is exactly why the
chapter notes AES-256 provides quantum-era margin.

SHOR'S ALGORITHM (threatens RSA, Diffie-Hellman, and ECC, this
chapter):
RSA and Diffie-Hellman/ECC don't rely on brute-force search at all --
they rely on specific mathematical problems (integer factorization for
RSA; the discrete logarithm problem for DH/ECC) being hard for ANY
known CLASSICAL algorithm to solve efficiently. Shor's algorithm isn't
a generic search speedup -- it's a fundamentally different quantum
algorithm specifically designed to solve exactly these two
mathematical problem types EFFICIENTLY, in polynomial time, on a
sufficiently large quantum computer. This doesn't just make the
problem somewhat easier the way Grover's algorithm does for brute
force -- it removes the hardness assumption those systems are built on
ENTIRELY.

Why this makes the two situations fundamentally different in severity:

Doubling AES's key size (Chapter 5's fix) restores full security
against Grover's algorithm, because Grover's speedup is bounded and
predictable -- you can simply out-scale it. There is no equivalent fix
available for RSA/DH/ECC against Shor's algorithm by simply using
larger keys, because Shor's algorithm doesn't get proportionally
harder against larger keys the way brute-force search does -- it
solves the underlying factoring/discrete-log problem efficiently
regardless of key size, on a sufficiently powerful quantum computer.
This is precisely why RSA, Diffie-Hellman, and ECC need to be REPLACED
with fundamentally different mathematical problems (post-quantum
cryptography, Chapter 12), while AES only needs a LARGER KEY to remain
safe.

WHY THIS WORKS AS AN ANSWER
------------------------------
This distinguishes the chapter's own two named algorithms by the
NATURE of what they attack -- a generic search speedup (Grover) versus
a targeted, complete solution to a specific structural hard problem
(Shor) -- which is exactly why the chapter states Shor's algorithm
"breaks every algorithm in this chapter outright" while Grover's is
merely "a manageable degradation," and why Chapter 12's post-quantum
work is scoped specifically to public-key cryptography rather than
symmetric ciphers.