hesela.devCryptographic erase
Cryptographic erase sanitizes the keys protecting encrypted target data so that recovering the plaintext becomes infeasible.
This can sanitize access without rewriting every ciphertext block. It requires suitable cryptography and key management, coverage of the target data before sanitization, and removal of every necessary copy of the target keys. Deleting an account password is not automatically key sanitization. Sensitive plaintext stored before encryption needs a different suitable treatment.
Relations
- related
- self-encrypting-drive, sanitize-nvme, data-sanitization, secure-erase
Advantages
- Can avoid a full-media rewrite when its cryptographic prerequisites are satisfied.
Limitations
- Backups or escrow copies of keys need separate assessment; ciphertext remains, so required long-term confidentiality also matters.