How to provide secure password based encryption with password reset option

Question

I am trying to build website that will encrypt some data for the user using his/her the output of scrypt on it, now the idea is that this schema is not flexible because if the user loose their password then all of their data is lost, instead came to following options:

Option 1 :

1. Generate random 128 bit key $k_1$

2. Generate random 128 bit recovery key $k_2$

3. Run scrypt on user password to get $k_3$

4. Give $k_2$ to user to save it in secure place and not save it in database

5. Encrypt $k_1$ once with $k_2$ and once with $k_3$ and once with $k_2$ and store them in database

6. When user forget their password he/she uses $k_2$ to decrypt the encryption key $k_1$ and then go to step 2.

Option 2:

1. Generate random 128 bit key $k_1$

2. Generate random 128 bit recovery key $k_2$

3. Use scrypt on user password to derive $k_3$

4. $k_4 = k_1 \oplus k_2$

5. $k_5 = k_1 \oplus k_3$

6. To encrypt we use the $k_1 = k_4 \oplus k_5$

7. Give $k_2$ to user to save it in secure place and not store it in database

8. When a user forgets their password he/she provides the system with $k_2$, then $k_1 = k_3 \oplus k_2$, go to step 2

Option 3:

1. Use scrypt on user given password, this will be $k_1$

2. Generate random 128 bit key for encryption $k_2$

3. Encrypt $k_2$ with $k_1$

4. Use Shamir shared secret with number of shares is $2$ and threshold is $2$ and the secret is $k_1$

5. Store share in database $s_1$, and give the other $s_2$ to the user to save it in secure place.

6. When a user forgets their password she/he will provide the system with his/her sahmir shared $s_2$, and using shamir secret sharing algorithm and the $s_1$ we obtain $k_1$ and then go to step 1.

Now my exact question is: What is the pro and cons for option 1, option 2 and option 3? Which one will be the most secure one? And which one will be the best from a performance perspective?

Answer 1

In every of these options the essential step is to save it in secure place. Instead of implementing any of these options, just tell the user to keep the password in the same secure place that you have in mind for the 2nd key. All major risks will be the same as for keeping there the 2nd key, but this solution will cost you nothing - no implementation, no costs.

To answer your question precisely: What is the pro ...? I don't see any "pro", because they are not more secure than keeping the original password at the same secure place. To "cons": additional complexity to implement such process and to maintain it without getting any more security.

In case of option 3 additional complexity (also without additional security) comes from the fact that 2 of 2 keys are needed. This is effectively the same as "simple" splitting of the key into 2 parts without using any complex method.