I am working on financial application where users' data are encrypted with symmetric cipher (AES-256), encryption keys is derived with KDF from user's password. I am looking for way how to give to my users some easy-to-store value (10-15 bytes long) that he stores in a safe and use it as "recovery key" when he forgot his password.
I am studying how
key-wrapping works and how it can be used to change (forgotten) password in application where password / passphrase is used as input for encryption key generation (
KDF). This article Encryption background: What is key wrapping? discuss how key wrapping works and how can be easy to change user password without need to re-encrypt user's data.
I understand there is no problem when I'm changing password that I know - I know my password, original encrypt key is unwrapped and re-wrapped with new key derived from new password; so far so good.
Question1: How can be key-wrapping mechanism used when I forgot my password? (password is used to create wrapping key). I think that in this situation it cannot done and user's data are lost because I cannot unwrap original encrypt key so I cannot re-wrap original encrypt key. Am I right or wrong?
Question2: Is there some way / mechanism / technique how can I decrypt encrypted symmetric cipher key (AES) with two secret values? One value is derived from password / passphrase and second is from something as Apple's recovery key. I am studying paper Infiltrate the Vault: Security Analysis and Decryption of Lion Full Disk Encryption but I'm not done yet.