Secure password reset

Question

In my model I use two different keys, one for authentication and the other for the encryption / decryption of the data that the user saves, each derived from the master password with a KDF function.

How can I safely manage the password recovery for the user if I have no trace of the master password on my database?

What do you think about https://mega.nz mode? In a nutshell:

1. When registering, it makes you download a file containing a key (I think your password or encryption / decryption key is encrypted with this random key and stored in their database).
2. In case of loss of the access password, it asks you to upload that file containing the key to reset the password.

Is it a good option? It can be done better?

Answer 1

You probably don't want to encrypt data with a key derived from a password directly with a KDF. This makes changing the password require rencrypting everything. You can instead encrypt data with a strong random key. And encrypt the key with a password derived key. This encrypted key is what you keep. You can also encrypt this key with other keys. Including a random key the user downloads and keeps wherever, possibly on paper. Or you can possibly split a key into multiple shares to be kept separately.

Obviously if you have multiple ways to decrypt your key, it is only as secure as the weakest method.