How it works
A medium that supports cryptographic erase encrypts data as it is written. The encryption key is stored on the device, usually wrapped by a second key. That second key comes from a password, a hardware security module, or a key-management service.
Data on the platters or flash cells is ciphertext from the first write. Nobody ever writes plaintext to the medium.
- 1
Encrypt on write
Every write is encrypted before it reaches the medium.
- 2
Protect the key
The key is kept in a small protected area, apart from user data.
- 3
Destroy the key
The ciphertext remains, but it can no longer be decrypted.
Fast at any size
Other sanitization methods must touch the data itself. Overwriting rewrites every block, and block erase clears every cell, so both take longer as capacity grows. Cryptographic erase destroys a key of a few hundred bytes. The operation finishes in seconds, even on a multi-terabyte drive. That makes it practical for storage arrays, mobile flash, and cloud volumes.
Where it applies
The technique appears in these common setups.
| Setup | What destroying the key does |
|---|---|
| Self-encrypting drives | The controller discards its internal key, wiping the whole drive |
| Mobile devices | Discarding the device key wipes encrypted storage almost instantly |
| Cloud volumes and VMs | Deleting a volume's key decommissions it without physical access |
| Disk and file encryption software | Deleting the key erases data within the scope of encryption |
Its place in sanitization
NIST Special Publication 800-88, the reference guide for media sanitization, lists cryptographic erase as a way to reach the purge level. Purge is strong enough for media that leave the organization.
The technique qualifies only if three conditions hold. The medium was encrypted before any sensitive data was written. The encryption strength meets current standards. The key-destruction mechanism is verified to work. If one condition is missing, the same action counts only as clearing, or not as sanitization at all.
Ordinary deleted files are not sanitized at all: the data stays readable until something overwrites it.
What can undermine it
Cryptographic erase is only as strong as the key management behind it. Deleting the on-device key does not delete other copies of it.
- A key copied to a backup, escrow, or key service keeps the data recoverable through those copies.
- Plaintext saved before encryption was enabled can leave recoverable remanence outside the encrypted area.
- A medium that was never encrypted, or whose encryption cannot be verified, needs overwriting, block erase, or physical destruction.
Where to start
Check when encryption was turned on for each device before choosing a method. Where it was on from the first write and the key destruction is verified, cryptographic erase is the fastest route to purge. Where it was not, plan for overwriting or physical destruction, and follow the wider media sanitization rules.
Further reading: Encryption, coding and hashing – what is the difference?.
A drive encrypted from the first write is easy to retire. A drive encrypted after the fact needs proof before anyone trusts it.
Anexet Team