I'm designing a system so that it encrypts a user's profiles. The only way of accessing the information stored in it is by either:
- Providing the password for the account
- Resetting the password using offline backup codes
- Resetting the password by sending an SMS code
We will assume that the device receiving the SMS code, nor the transportation method of the SMS, is not compromised.
In order for the three methods to grant access to the user's profile, a key will be generate to encrypt and decrypt the profile. We will then store encrypted versions of the key so that each of the following methods listed above can access the information in the profile.
For method 1 & 2, ensuring that the key remains confidential is easy. For method 1 simply encrypt the key using the user's password. For method 2 generate the backup codes, encrypt the key with them, and then give them to the user. For method 3 however, I'm not sure how this should be done.
Question 1: How can I provide a feature that allows a user to recover their account by sending a SMS code to their device, such that the organisation that stores the data cannot access the information in the user's profile?
Question 2: A company allows users to reset their passwords using SMS. Does this imply that the company can access information stored in their user's account?
An organisation is able to modify the system so that they can retrieve whatever data was encrypted - just make sure that the next time the user logins in you store a copy of their password. However, in the event that an adversary obtains a copy of the accounts, my question still remains valid.