Key Version Management in Storage Devices

Aspects of a storage device are provided for managing a key version used for encryption and decryption and processing host commands associated with sanitized and non-sanitized logical pages using cryptographic erase. A controller of the storage device updates, in response to a sanitize command, a current address offset associated with the KV from a first address offset to a second address offset without changing the KV. In response to a subsequent read command, the controller determines whether the KV mismatches an expected KV obtained from the metadata beginning at the second address offset but matches or mismatches an expected KV obtained from the metadata beginning at the first address offset. The controller transmits garbage data decrypted using a different KV than the KV if a match, or an error message indicating a KV mismatch error if a mismatch. Thus, the controller may avoid returning garbage data for non-sanitized logical pages.