How to devise cryptographic system with data-sharing ability and password reset I originally posted this in the security.stackexchange forums but then I was directed to this one which seems more befitting for my question.
I am writing a C# .NET application. For my application the following requirements should be met:

The data of the users should be stored encrypted in the database
Users can share data with other users
I, as the developer, should be unable to decrypt any user data
If the user resets their password, previously encrypted data should still be possible to decrypt
The private key should not be stored anywhere on disk. Ideally, I want the client application to be able to derive the private key, for example from the password, every time the user logs in.

I cannot seem to find a solution that meets all five requirements. So far, I have come up with the following cryptographic system using asymmetric encryption: When a user registers, a public-private key pair is derived based on the user password (Is that even possible/practical?). The public key is stored in the database. When the user shares data with another user, it is encrypted with that other user's public key and stored in the database. But now req. 4 is not met, since the key pair is based on the current password a reset will render all previously encrypted data undecryptable.
If instead I use symmetric encryption to encrypt the data, then I can encrypt the encryption key using some password based key, which solves req. 4. However, then I am unable to meet req. 2 i.e. share data with other users. This is, of course, because the user would need the other user's symmetric data encryption key which is encrypted with the private key.
So I am finding myself stuck and unable to come up with a solution that fixes all issues simultaneously.
The phrase &quot;password reset&quot; is not applicable for encryption.
Password reset means that starting from some moment only a new password can be used and none of the previous passwords can be used any more. For encryption this is not possible, because if some password (key) can be used for decryption, it can still be used without any limits. For instance, if reset was possible and user reset password to a new one, then a few days later found the previous password, this password would obviously still be able to decrypt the same data.
Thus, we cannot call it &quot;reset&quot;. The requirement to be able to decrypt the data in case user forgotten the password actually means:

either you may help user to restore the current password (decryption key)
or, if encryption scheme allows multiple decryption keys, you give user an additional password (key)

In both cases you as a developer can obtain a password (decryption key) not only when user asked you about this, but also on your own. Thus, the requirement 3 would be violated.
Any schemes with secret sharing don't fit these requirements as well. If you implement secret sharing where user has one part of the additional decryption key, this can also be lost. If you implement secret sharing where user has none of parts of shared secret, then the secret (decryption key) can be restored without the user knowing about that, thus the requirement 3 would be violated.
Briefly: There is no way to fulfill all your requirements simultaneously. This has nothing to do with cryptography, this is just a common sense.  Means, at least one of requirements need to be changed.