Q:

What does "a 15360-bit RSA key is the equivalent to a 256-bit symmetric key" mean?

NIST key management guidelines suggest that 15360-bit RSA keys are equivalent in strength to 256-bit symmetric keys. If a 15360-bit RSA key is the equivalent to a 256-bit symmetric key, does that mean a 15360-bit RSA key can prevent factoring  by the strongest quantum computers in the next 100 years or so? If not, how can the following statement be true?

…a 15360-bit RSA key is the equivalent to a 256-bit symmetric key.

So, a 256-bit symmetric key could be reduced to 128-bit with Quantum computers (Grover's algorithm). Even if it takes 20 years or so from now to develop a strong enough quantum computer, once quantum computers become strong enough, a 256-bit symmetric key would still be strong enough to prevent brute forcing when the keys are random enough. So, do they think a strong quantum computer can factor 15360-bit RSA keys using Shor's algorithm (or any similar algorithm) in 100 years or so from now?

A:

The statement 

a 15360-bit RSA key is the equivalent to a 256-bit symmetric key

does not take into account quantum algorithms. In fact, it is based on a specific computation model. 
It is just based on the fact that there exist sub-exponential algorithms for factoring and therefore you need longer keys than when using symmetric-key crypto where it is believed that there is no attack that is more efficient than exhaustive search.
I'm not 100% sure, but I think the NIST standard is based on a paper by Lenstra and Verheul (PDF).

