Crypto‑shredding does not delete anything from your old backups

说明与用途

删除记录的加密密钥并不能使其在旧备份中不可恢复。通过轮换并销毁主密钥，可确保已删除的记录在最后一次密钥销毁之前的任何备份中都无法恢复。

问题

Erasing a record by deleting its encryption key leaves the record recoverable from older backups because the wrapped key remains in those backups.

结果

By rotating and destroying the master key, erased records become unrecoverable from all backups older than the last key destruction, aligning the erasure guarantee with the rotation cadence.

工作流

• 1. Generate a new master key and load both new and old keys. 2. Re‑wrap every live DEK under the new master key (update only the wrapped key, not the ciphertext). 3. Destroy the old master key everywhere (environment, file, KMS, backups). 4. Ensure the rotation process guards against concurrent erasures, pages updates, skips unopenable rows, and stops on network errors.
• 5. Record the date of the last key destruction for audit purposes.

证据

Restore last month's backup, point the service at it with the current master key, and the erased record is back.

来源

After step 3, every backup taken before the rotation holds wrapped DEKs under a key that no longer exists.

来源