The owner passphrase (#3594111) is opt-in and has no recovery: a forgotten passphrase leaves the vault permanently unreadable, by design. For owners who accept the protection but want a safety net, offer an optional recovery code at enable time.

Sketch: when enabling the passphrase, optionally generate a high-entropy recovery code and wrap the Subject KEK a second time under a key derived from it (same two-layer shape as the passphrase, Master KEK on top), so either the passphrase or the recovery code can unwrap. Show the code once, tell the owner to store it offline, never persist it. Recovery must not weaken the operator-lockout property: the code is owner-held only.

Open questions: regenerate/invalidate the code on rotate; whether to allow more than one code; UX for "I lost my passphrase, use my recovery code".

Follow-up to #3594111, sibling of #3594299. Part of the roadmap meta #3593605.

Comments

mably created an issue.