I've got a dilemma here: I'm working on a system that will connect to remote linux servers for monitoring and automating some processes. Since user+pass is insecure for obvious reasons and public/private key pairs exist for a reason, my site generates a key pair and gives the public key to the user (for uploading to their server) but in case the user forgets their public key I'd like to give them a way to recover it.
However, if I encrypt the public key with the user's password, if a hacker gets into the database, even if the password is hashed, they can use that hash to decrypt the public key, so it would make no sense. I started to think in using OTP instead and ask it at key generation phase and key view phase.
What do you think? Is this method secure? Are there any better ways to secure this? Actually, what I'd like to archieve is something like using a master password/key to unencrypt that data, something that the user has, but at the same time I can use to unencrypt the data in case my system needs it... For instance, for logging in I've got to compare the password somehow, right? and to unencrypt the public key for display I've got to do it as well.
Any pointers or ideas would be very welcome, as I've spent around two days fully thinking about this issue but I've found no hacker-free way to do so. I know everything is hackable, but I wouldn't mind if it's done somehow that it'll take around 10 GTX 1080s to decrypt the information, that'll give me enough time to act I think. Am I wrong?