http://www.pqcrypto.org/www.springer.com/cda/content/documen...
http://www.pqcrypto.org/www.springer.com/cda/content/documen...
> Quantum computers can't break modern symmetric crypto.
Much like we don't have proofs that it is classically secure we also don't have proofs it is secure in a quantum setting. But absence of proof is not proof of absence. In fact we know that Grover's algorithm halves the strength of any hash function. In general you should assume that symmetric cryptography is easier to break on a quantum computer than on a classical one because they are strictly more powerful.
In case of RSA and Elliptic Curves, we known there are theoretical quantum algorithms that undermine the security. But for Lattice cryptography there are actually proofs that they remain secure in a quantum setting.