Decommissioning keys in a decryption storage system

1. A method, comprising;

scanning a storage system to identify data based on metadata associated with a current key to be decommissioned;

encrypting, with the current key, the data to generate encrypted data;

decrypting the encrypted data with a first candidate key to generate first decrypted data;

decrypting the encrypted data with a second candidate key to generate second decrypted data;

selecting a target key from the first candidate key and the second candidate key based on comparing a first compression metric associated with the first decrypted data to a second compression metric associated with the second decrypted data; and

storing the decrypted data and modified metadata to the storage system, wherein the modified metadata replaces the current key with the target key.

2. The method of claim 1 , wherein the target key is a null key.

3. The method of claim 1 , wherein the scanning is in response to receiving an instruction to decommission the current key to comply with one or more security protocols of the storage system.

4. The method of claim 1 , further comprising:

receiving instructions to decommission a plurality of keys, comprising the current key;

determining that the plurality of keys exceeds a batch-processing threshold; and

in response to the determining, batch-decommissioning the plurality of keys.

5. The method of claim 1 , further comprising;

determining a difference in storage utilization between the data and the decrypted data; and

providing a notification to a client device when the difference in storage utilization exceeds an efficiency threshold.

6. The method of claim 5 , further comprising:

receiving an indication, from the client device, to proceed in view of the difference in storage utilization; and

allowing the decommissioning of the current key in response to the indication.

7. A storage system comprising:

a storage array comprising one or more storage devices; and

a storage array controller operatively coupled to the storage array, the storage array controller comprising a processing device to:

scan the storage array to identify data based on metadata associated with a current key to be decommissioned;

encrypt, with the current key, the data to generate encrypted data;

decrypt the encrypted data with a first candidate key to generate first decrypted data;

decrypt the encrypted data with a second candidate key to generate second decrypted data;

select a target key from the first candidate key and the second candidate key based on comparing a first compression metric associated with the first decrypted data to a second compression metric associated with the second decrypted data; and

store the decrypted data and modified metadata to the storage system, wherein the modified metadata replaces the current key with the target key.

8. The storage system of claim 7 , wherein the storage system uses a best effort encryption/decryption schema.

9. The storage system of claim 7 , wherein the target key is a null key.

10. The storage system of claim 7 , wherein the scan is in response to receiving an instruction to decommission the current key to comply with one or more security protocols of the storage system.

11. The storage system of claim 7 , the processing device further to:

receive instructions to decommission a plurality of keys, comprising the current key;

determine that the plurality of keys exceeds a batch-processing threshold; and

in response to the determining, batch-decommission the plurality of keys.

12. The storage system of claim 7 , the processing device further to:

determine a difference in storage utilization between the data and the decrypted data; and

provide a notification to a client device when the difference in storage utilization exceeds an efficiency threshold.

13. The storage system of claim 12 , the processing device further to:

receive an indication, from the client device, to proceed in view of the difference in storage utilization; and

allow the decommissioning of the current key in response to the indication.

14. A non-transitory computer-readable storage medium storing instructions, which when executed by a processing device, cause the processing device to:

scan the storage array to identify data based on metadata associated with a current key to be decommissioned;

encrypt, with the current key, the data to generate encrypted data;

decrypt the encrypted data with a first candidate key to generate first decrypted data;

decrypt the encrypted data with a second candidate key to generate second decrypted data;

select a target key from the first candidate key and the second candidate key based on comparing a first compression metric associated with the first decrypted data to a second compression metric associated with the second decrypted data; and

store the decrypted data and modified metadata to the storage system, wherein the modified metadata replaces the current key with the target key.

15. The non-transitory computer-readable storage medium of claim 14 , wherein the target key is a null key.

16. The non-transitory computer-readable storage medium of claim 14 , the processing device further to:

determine a difference in storage utilization between the data and the decrypted data; and

provide a notification to a client device when the difference in storage utilization exceeds an efficiency threshold.

17. The non-transitory computer-readable storage medium of claim 16 , the processing device further to:

receive an indication, from the client device, to proceed in view of the difference in storage utilization; and

allow the decommissioning of the current key in response to the indication.