NIST SP 800-88 Rev 2 3.2.3: Sanitization of keys: zeroize every copy of the target cryptographic keys and all keys beneath them, eliminate unwrapped copies in volatile memory or registers, and consider external key recovery paths

What does 3.2.3 require?

CE aims to make the ciphertext of sensitive information permanently undecryptable by sanitizing the target cryptographic keys: the keys that encrypt the data or that control access to them. ISO/IEC 19790 zeroization is the recommended technique (overwriting with zeros, ones or random data), and ISO/IEC 27040 requires that every copy of the target keys can be sanitized. Target keys may be the symmetric keys that encrypt data, the symmetric keys that wrap other keys, master or derivation keys (sanitizing any one of jointly used derivation keys defeats derivation), or private key-transport keys; sanitizing a public key-transport key is not valid because copies cannot be eliminated. All keys hierarchically below the target keys are eliminated or actively erased as well. Unwrapped copies of keys that were loaded into volatile memory or an encryption engine register before the CE must also be eliminated, preferably by direct sanitization, otherwise by a hard reset or powering the ISM off for a period. Where a target key, or any key at or below the sanitized level, exists outside the ISM (injected from a key management server or escrow), it could be used later to recover the data, and ISO/IEC 27040 asks that this be weighed before relying on CE.