How to implement reset password for a password manager

Question

How could I best implement a reset password functionality for a password manager? I'm currently saving a hashed + salted master password, which is hashed with PBKDF2, and encrypting the passwords with the master password itself, however if a user has lost his master password this means the passwords can't be decrypted.

I thought about saving a version of the passwords encrypted with the master password and a version encrypted with the users email + some random token generated when the user creates his account, but would this be safe? Is there any best practice when doing this?

The user's email also only gets stored as a hash.

So to clarify my question, are there any best practices for recovering data encrypted with a password if that password is lost?

EDIT

My current idea is generating a second key to encrypt all passwords, and encrypting this key in an image through steganography the user can store on an usb, but then all passwords would be saved twice in the database (encrypted both times), so I don't know if that's a risk or not.

EDIT 2

Final version, with the help of @A.Hersean 's answer.

I'm going to generate a key with which all passwords are encrypted, and this key itself can be encrypted with a password and backup password (which is saved inside an image) and those two encryptions of the key will then be saved to the database.

Answer 1

To answer your question "So to clarify my question, are there any best practices for recovering data encrypted with a password if that password is lost?", the best practice is you don't recover encrypted data when you loose your password. Because the point of encryption is to not be able to decrypt without the password, being able to do otherwise will weaken your encryption scheme. So you must ensure not to loose the password in the first place, for example by writing it down and placing it into a safe.

For your question "a version encrypted with the users email + some random token generated when the user creates his account, but would this be safe?", the answer is no, that wouldn't be safe. Because you will have to save the token (and the email address or its hash), it's the same as saving the password in clear text.

If you need flexibility, don't encrypt data with a password. Encrypt your data with a randomly generated encryption key, then encrypt this key with a password and save the key in its encrypted form. You can then encrypt the key with other passwords and save it too, maybe elsewhere (in a vault). Keep in mind that the resulting strength of the encryption will be the one of the weakest password used.

Answer 2

This is essentially a followup to @MarkoVodopija's answer. The rationale behind password recovery for encryption is just to store the password or the key in a safe place, because only a backdoor or a major flaw in the encrytion software can allow to read the data without the key

Depending on what you accept as safe will lead to different solutions. Besides the ones proposed by Marko you have:

• write it on a paper and store it in a sealed enveloppe in a physical safe. It used to be a good practice for admin passwords, and it is a really bullet proof way... if you can trust all owners of the safe key.
• share it with someone you trust - and trust him/her to not forget it... But this is more appropriate for shared secrets, and if you think you can forget it, why could not the other person forget it too?
• in a corporate Microsoft network, it is common for the key used for encrypted folders to be encrypted once with the owner's private key and once with a network admin accessible key to allow the system admin to unlock the folders if the employee were to leave without first giving everythin to someone else - in case of an accident for example.

Answer 3

When you derive a key from user password, there is no simple way to have reset password functionality. Please see this and this for an example of a well known implementation and how a password reset is solved.

Many implementations have recovery key functionality in case master key is lost (or forgotten in your case). BitLocker is one example.

You might consider creating password reset key and send it to the user email upon registration. This can be compromised if user email is hacked though.

Other option is to have recovery key shared (using Shamir's Secret Sharing algorithm for example) between two or more users/administrators so in case of a reset, multiple parties are needed to reset the password for given user. Something similar is done in Vault.

I believe there is no any specific best practice just some well known implementations. It all depends on your design needs.