--- title: Why Seven-Year Call Recordings Need Post-Quantum Keys | CoreCx AI url: https://www.corecx.ai/insights/post-quantum-keys-for-seven-year-call-recordings/ description: Harvest now, decrypt later puts long-retention call recordings at risk. What ML-KEM (FIPS 203) changes, and six steps to protect your recording archive now. publisher: CORECXAI PTE. LTD. updated: 2026-11-02 --- Guide # Why seven-year recordings need post-quantum keys Call recordings kept for seven years or more will still exist when quantum computers can break today's key exchange. What changes for retention, and what to do now. 31 October 2026 · 6 min read · CoreCx AI **In this guide**[The problem: harvest now, decrypt later](#)[Why call recordings are first in line](#)[What quantum computing actually breaks](#)[The standards are ready](#)[What to do now](#)[How CoreCx does it](#) [All insights](https://www.corecx.ai/insights/) ## The problem: harvest now, decrypt later An attacker does not need a quantum computer today to put your recordings at risk. They only need to copy encrypted files or captured traffic now and keep them. When a large enough quantum computer exists, the public-key algorithms in wide use today, RSA and elliptic-curve cryptography, can be broken, and everything protected by them can be opened. Security agencies call this **harvest now, decrypt later**. It matters most for data that must stay confidential for a long time, and call recordings are exactly that kind of data. ## Why call recordings are first in line Regulated organisations keep recordings for years. Trading and advice calls in the European Union must be kept for at least five years under MiFID II, and up to seven when a regulator asks. Many banks, insurers and public bodies keep conversations for seven years or more for disputes, complaints and investigations. Those recordings hold exactly what an attacker wants: identity checks, account details, health information and the voices of customers and staff. A recording made in 2026 and kept until 2033 must stay confidential for the whole period, so it has to be protected against the attacks of 2033, not just today's. ## What quantum computing actually breaks Most recording systems use two layers of protection. - **The audio itself** is encrypted with a symmetric cipher such as AES-256. Quantum computers weaken symmetric ciphers only modestly, and AES-256 is still considered safe. - **The key that unlocks each recording** is usually protected, or wrapped, with RSA or elliptic-curve cryptography. This is the layer a quantum computer breaks. So the fix is not to re-encrypt every recording with a new cipher. It is to change how the keys are wrapped. ## The standards are ready In August 2024 the United States National Institute of Standards and Technology (NIST) published FIPS 203, which standardises ML-KEM, a key-encapsulation mechanism designed to resist quantum attacks. NIST has also proposed retiring today's quantum-vulnerable public-key algorithms by 2035. A sensible way to adopt it is a **hybrid** mode: each key is protected by both a classical algorithm and ML-KEM, so it stays safe unless both are broken. ## What to do now 1. **Find out what you keep.** List every recording store, its retention period and the encryption it uses today. 2. **Give every recording its own key.** A single compromised key should open one call, not an archive. 3. **Wrap those keys with ML-KEM in hybrid mode.** Start with new recordings, then re-wrap the keys of the archive. The audio does not need to be re-encrypted. 4. **Keep keys away from the media.** Hold them in a dedicated key management system, never in the same store as the recordings. 5. **Make sure no one person can open everything.** Split the root secret between custodians and log every key operation. 6. **Plan for rotation and destruction.** Old keys must still open old recordings, and destroying a key should provably destroy access to its recordings at the end of retention. ## How CoreCx does it iFlux Recorder encrypts each recording with AES-256-GCM under its own key the moment it is written. CoreSec KMS wraps those keys with ML-KEM in a hybrid mode, splits the root secret between two custodians and keeps keys separate from the media. Archived and retired keys still decrypt older recordings, and the whole estate can run on-premise, including air-gapped sites, or in your own cloud. **Key takeaways** - Recordings captured today can be copied now and decrypted later. Retention periods of five to ten years fall inside that window. - AES-256, the cipher that encrypts the audio, stays strong. The weak point is the public-key step that protects each recording's key. - NIST published ML-KEM, its first post-quantum key-encapsulation standard (FIPS 203), in August 2024. - Give every recording its own key, wrap those keys with ML-KEM, and keep the keys away from the media. **The products behind it**[**CoreSec KMS**Post-quantum key management that keeps your recordings yours.](https://www.corecx.ai/products/coresec-kms/)[**iFlux Recorder**Multivendor call recording, compliance-grade and sealed the moment every call is written.](https://www.corecx.ai/products/iflux-recorder/)[**CoreCx EL**The hardened operating system every CoreCx product runs on, secure from the first boot.](https://www.corecx.ai/products/corecx-el/) ## Frequently asked questions about this guide Do we need to re-encrypt our whole recording archive to become quantum-safe? Usually not. The audio is normally encrypted with AES-256, which remains strong. What needs to change is how each recording's key is wrapped. Re-wrapping keys with ML-KEM protects the archive without re-encrypting the audio. What is ML-KEM? ML-KEM is the post-quantum key-encapsulation mechanism standardised by NIST in FIPS 203 in August 2024. It protects encryption keys against attacks by future quantum computers. When will quantum computers break today's encryption? Nobody can give a date. The risk for recordings is that encrypted copies taken today can be decrypted later, so data that must stay confidential for seven years or more needs post-quantum protection now. ## More insights [All insights](https://www.corecx.ai/insights/) [ Briefing ### Regulated contact centres, 2026 7 min readRead ](https://www.corecx.ai/insights/regulated-contact-centres-2026/)[ Playbook ### Leaving a legacy recorder without losing a call 6 min readRead ](https://www.corecx.ai/insights/leave-a-legacy-call-recorder-without-losing-a-call/) ## Talk it through with a specialist Bring your phone system, your retention rules and your regulator. We will map every line to a product and a setting. Contact us ## Talk to the right team. Call us, email us, or choose a form. A CoreCx specialist replies within one business day. [**Sales** Pricing, licensing, proposals and a demo on your own phone system. Contact Sales](https://www.corecx.ai/contact/) [**Product** Architecture, sizing, security packs, integrations and proof-of-concept requests. Contact Product](https://www.corecx.ai/contact/#product) [**Partners** Resellers, systems integrators and managed service providers who want to work with us. Become a partner](https://www.corecx.ai/contact/#partner) **Phone**[+65 9653 8072](tel:+6596538072)Monday to Friday, 9:00 to 18:00 Singapore time (UTC+8) **Email**[contact@corecx.ai](mailto:contact@corecx.ai)We reply within one business day **Singapore · HQ**_CORECXAI PTE. LTD._60 Paya Lebar Road #05-09 Paya Lebar Square Singapore 409051[Get directions](https://www.google.com/maps/search/?api=1&query=60+Paya+Lebar+Road+Paya+Lebar+Square+Singapore+409051) **Sydney · Australia**_CORECXAI PTY LTD_Suite 2, Level 3 13–15 Wentworth Avenue Sydney NSW 2000[Get directions](https://www.google.com/maps/search/?api=1&query=13-15+Wentworth+Avenue+Sydney+NSW+2000) **LinkedIn**[Follow us on LinkedIn](https://www.linkedin.com/company/corecx-ai/)News, product updates and careers Contact: contact@corecx.ai · https://www.corecx.ai/contact/