Imagine an authenticated, encrypted file system, which uses AES-256-CTR to encrypt a 64 KB file sector, then uses HMAC-SHA256 to authenticate the 64 KB file sector (including the IV). IVs are 128-bit, randomly generated.
The global 256-bit encryption and 256-bit authentication keys are independent of each other, and are used across all files (i.e. no per-file keys).
The file system needs to be able to crypto-shred individual files, and needs to sustain 100,000 IOPS.
How would you implement crypto-shredding without deriving per-file keys per operation (or without caching thousands of derived per-file keys in memory)?
Instead of deriving per-file keys, would XORing the stored public sector IV with a secret per-file SALT be adequate? In other words, the random IV (which is stored on disk) would be XORed with a secret per-file SALT when encrypting or decrypting. Assume the per-file SALT can be erased when the file needs to be crypto-shredded.
This should avoid the need for 100,000 HKDF or PRF calls per second to derive per-file keys.
Crucially, since the system is garbage collected, this would also avoid having 100,000 derived per-file keys scattered throughout memory at any point in time, and avoid bugs related to the caching and versioning of these keys.
Crypto-shredding usually operates by erasing the key, but erasing the SALT used to generate the final IV seems to make more sense. I don't know if I'm missing something here?