Destroy a key and confirm the data is unreadable

short · 50 min · Objective 4.5

Task

Crypto-shredding is the cloud's answer to secure erasure, and it is only convincing once you have done it. Encrypt data with a key you control, make copies, then destroy the key and confirm every copy is unreadable.

Steps

  1. Create a key in a local key management tool. Encrypt lab/crypto/data.txt with it and confirm you can decrypt it.
  2. Make three copies of the ciphertext in different locations, standing in for a backup, a snapshot and a cross-region replica. Confirm each decrypts correctly.
  3. DISABLE the key. Attempt to decrypt all three copies and record the failures in lab/crypto/shred.md. Then re-enable it and confirm they decrypt again -- disabling is reversible, which is why it is the first response to a suspected compromise.
  4. Now DESTROY the key. Attempt all three decryptions again and record the results.
  5. Write the two sentences this proves: what crypto-shredding does to copies you cannot enumerate, and why a key missing in a destination region breaks a cross-region restore.

Verify

grep -Eci 'disabl' lab/crypto/shred.md
grep -Eci 'destroy' lab/crypto/shred.md
grep -Ec 'fail|cannot|unable|error' lab/crypto/shred.md
grep -Eci 'reversib|re-enabl' lab/crypto/shred.md

All four non-zero, and the file must record decryption working again after re-enabling. If it did not, the key was destroyed rather than disabled and the reversibility point was not demonstrated.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.