I am tasked to change our users current login method to a more secure one (at the moment all password are stored in clear text in the database...).
The problem is, all passwords must be on the customer's local network (as they should be able to work even without internet connection), but we should still be able to recover them and tell them to users in case they forget.
I tried to push for the standard "hashing and salting + password reset if required" solution, but it was deemed too complex.
I was thinking about using asymmetric encryption, so we can deploy a public key to customers and encrypt all passwords with it (checking the encrypted password at login time, as you normally do with hashes), and keep the private key so we can eventually decrypt the password if required.
Is this actually secure (provided we keep the private key for ourselves) or should we resort to another method?