Providing a SMS recovery feature without compromising the security of an account

Question

I'm designing a system so that it encrypts a user's profiles. The only way of accessing the information stored in it is by either:

1. Providing the password for the account
2. Resetting the password using offline backup codes
3. Resetting the password by sending an SMS code

We will assume that the device receiving the SMS code, nor the transportation method of the SMS, is not compromised.

In order for the three methods to grant access to the user's profile, a key will be generate to encrypt and decrypt the profile. We will then store encrypted versions of the key so that each of the following methods listed above can access the information in the profile.

For method 1 & 2, ensuring that the key remains confidential is easy. For method 1 simply encrypt the key using the user's password. For method 2 generate the backup codes, encrypt the key with them, and then give them to the user. For method 3 however, I'm not sure how this should be done.

Question 1: How can I provide a feature that allows a user to recover their account by sending a SMS code to their device, such that the organisation that stores the data cannot access the information in the user's profile?

Question 2: A company allows users to reset their passwords using SMS. Does this imply that the company can access information stored in their user's account?

An organisation is able to modify the system so that they can retrieve whatever data was encrypted - just make sure that the next time the user logins in you store a copy of their password. However, in the event that an adversary obtains a copy of the accounts, my question still remains valid.

Answer 1

I don't think this is possible, with 1 and 2 you are effectively giving the user full control of the encryption keys and making sure the server does not know them. However, with 3 you need to generate new keys.

However, for securing against an attacker getting a copy of your database, a HSM will help. An HSM is a hardware storage of private keys, meaning it is impossible to copy the private key.

For your SMS-application, you would encrypt the profile key with the public part of the HSM keypair. When you need to generate an SMS-key, you can have the HSM decrypt the profile key and either re-encrypt it with the SMS-password (as you do with the regular password), or just use this as a part of the password-reset process (decrypting and re-encrypting when the user sets the new password).

There might be advanced cryptographical tools I don't know, maybe zero knowledge proofs could be used, however, this sounds like PhD-research-level stuff.