I'm developing a system that manages and shares user passwords (which are encrypted using user generated symmetric keys). But of course a big concern is the user losing their symmetric key and the data becoming unrecoverable.
Which has led me to thinking about a system generated symmetric key. So that the user merely authenticates him/herself and it is the system that possesses the key (or knows how to generate the same key) and decrypts and sends the data.
I guess my question is: If this were open source, and everyone can see the code, (so it won't work that I have some seed hardcoded) is there any conceivable paradigm in which a system can generate a key, not store it (for security reasons), but be able to reproduce that same key, without anyone who has open access to the code learning what the key could be?
Even reading it now it sounds too good to be true, but I figured I'd ask anyway.
Thanking you in advance, Jeffrey