Crypto‑shredding does not delete anything from your old backups

Описание и применение

Удаление ключа записи не делает данные недоступными в старых резервных копиях. Чтобы гарантировать удаление, необходимо вращать и уничтожать мастер‑ключ, после чего старые резервные копии становятся бесполезными для восстановленных записей.

Задача

Erasing a record by deleting its encryption key leaves the record recoverable from older backups because the wrapped key remains in those backups.

Результат

By rotating and destroying the master key, erased records become unrecoverable from all backups older than the last key destruction, aligning the erasure guarantee with the rotation cadence.

Рабочий процесс

• 1. Generate a new master key and load both new and old keys. 2. Re‑wrap every live DEK under the new master key (update only the wrapped key, not the ciphertext). 3. Destroy the old master key everywhere (environment, file, KMS, backups). 4. Ensure the rotation process guards against concurrent erasures, pages updates, skips unopenable rows, and stops on network errors.
• 5. Record the date of the last key destruction for audit purposes.

Доказательства

Restore last month's backup, point the service at it with the current master key, and the erased record is back.

Источник

After step 3, every backup taken before the rotation holds wrapped DEKs under a key that no longer exists.

Источник