An apparatus includes a storage medium and a controller. The storage medium generally stores user data in logical pages. The controller may be configured to encrypt and decrypt user data during write and read operations, respectively. The user data is generally in a plurality of data bands. Each data band is encrypted and decrypted using a unique media encryption key. When a boundary between a pair of data bands is within a logical page, the controller may be configured to create two logical page instances, a first logical page instance storing data from a first data band of the pair of data bands and a second logical page instance storing data from a second data band of the pair of data bands. The first and second logical page instances are encrypted and decrypted using the unique media encryption key of the first and second data bands, respectively.