Backdoorable hash function in password database
You can simply handle password verification on login and escrow independently:


Store a salted password hash (e.g. bcrypt) together with its salt. You can use this to verify logins, just like what you'd use if you had no escrow.
Also store the password encrypted with asymmetric encryption (e.g. RSA-OAEP, ECIES).

Since these are randomized, they are not vulnerable to attacks where the attacker guesses a password and checks if the encryption matches the ciphertext.

You might need to add some padding, to avoid leaking the length of the password.




The Makwa password hash has a built-in backdoor, but since this problem can be solved generically, I don't consider that a good reason for using Makwa over another hash.