Crypto erase vs block erase: which is right?
Two ways to reach Purge on an NVMe drive. One takes seconds and trusts the drive's encryption; the other takes longer and trusts nothing.
NVMe's Sanitize command has three modes. Two of them — cryptographic erase and block erase — both qualify as NIST 800-88 Purge, but they achieve it in opposite ways.
Cryptographic erase
Crypto erase doesn't touch the data. Instead, it destroys the drive's internal encryption key. Because every block was stored encrypted with that key, the data becomes unrecoverable the instant the key is gone — typically in a matter of seconds.
Its strength is speed and completeness. Its caveat is that it rests on the drive's encryption having been implemented correctly in the first place. If the vendor's key management had a flaw, the erase inherits that flaw.
Block erase
Block erase physically erases every flash block at the hardware level. It's slower than crypto erase, but it doesn't depend on any encryption implementation — the cells are simply cleared.
That independence is why some auditors and security teams prefer it for the most sensitive media: block erase removes doubt that a buggy or non-standard encryption scheme could leave data recoverable.
How they compare
| Crypto erase | Block erase | |
|---|---|---|
| Mechanism | Destroy encryption key | Erase flash cells |
| Speed | Seconds | Minutes to hours |
| Depends on | Encryption implementation | Nothing |
| NIST 800-88 | Purge | Purge |
Which should you use?
For the vast majority of drives, crypto erase is the right default — it's fast, complete, and standard on modern NVMe drives. Reach for block erase when the data is exceptionally sensitive, when your compliance regime demands implementation-independent erasure, or when you simply want to remove any dependence on the drive vendor's encryption.
Related: PSID revert is crypto erase too
PSID revert on a self-encrypting drive is effectively a cryptographic erase — it destroys the drive's encryption key to unlock it. So the same caveat applies: it's complete and instant, but it trusts the SED's encryption implementation. See the PSID revert guide for the details.
FAQ
Is crypto erase "weaker" than block erase?
Both map to Purge. Crypto erase is only weaker in the narrow case where the drive's encryption was badly implemented. For most organisations the practical difference is time, not security.
Can tScrub run either mode?
Yes — tScrub detects which Sanitize modes a drive advertises and runs the strongest supported one, recording the mode used in the report.