Crypto‑shredding does not delete anything from your old backups

Description and use

Deleting a record’s encryption key leaves the data recoverable from older backups. Rotating and destroying the master key ensures erased records are unrecoverable from any backup older than the last key destruction.

Problem

Erasing a record by deleting its encryption key leaves the record recoverable from older backups because the wrapped key remains in those backups.

Outcome

By rotating and destroying the master key, erased records become unrecoverable from all backups older than the last key destruction, aligning the erasure guarantee with the rotation cadence.

Workflow

• 1. Generate a new master key and load both new and old keys. 2. Re‑wrap every live DEK under the new master key (update only the wrapped key, not the ciphertext). 3. Destroy the old master key everywhere (environment, file, KMS, backups). 4. Ensure the rotation process guards against concurrent erasures, pages updates, skips unopenable rows, and stops on network errors.
• 5. Record the date of the last key destruction for audit purposes.

Evidence

Restore last month's backup, point the service at it with the current master key, and the erased record is back.

Source

After step 3, every backup taken before the rotation holds wrapped DEKs under a key that no longer exists.

Source