Cryptographic Erasure.

Rendering encrypted data unrecoverable by securely destroying the encryption keys instead of overwriting the storage media itself. It belongs to the Cryptography category of cybersecurity.

Rendering encrypted data unrecoverable by securely destroying the encryption keys instead of overwriting the storage media itself.

Cryptographic erasure, sometimes called crypto-shredding, sanitizes data by destroying the keys used to encrypt it, so the ciphertext remains physically present but is unreadable. NIST SP 800-88 lists it as an accepted media-sanitization method when the data was always stored encrypted with strong algorithms (AES-256 or equivalent) and well-managed keys. It is widely used in self-encrypting drives, mobile devices (iOS effaceable key), cloud KMS-backed storage, and tape backups, where physical wiping is slow, impossible, or impossible to verify. To be effective, every copy of every wrapping key must be destroyed, including HSM-resident master keys, backups, and escrow material. Auditable key-destruction logs are required for compliance.

Defences for Cryptographic Erasure typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Crypto-shredding, Key destruction sanitization.