Can key-wrapping help to securely change passphrase used to generate encryption key? I am working on financial application where users' data are encrypted with symmetric cipher (AES-256), encryption keys is derived with KDF from user's password. I am looking for way how to give to my users some easy-to-store value (10-15 bytes long) that he stores in a safe and use it as "recovery key" when he forgot his password. 

I am studying how key-wrapping works and how it can be used to change (forgotten) password in application where password / passphrase is used as input for encryption key generation (KDF). This article Encryption background: What is key wrapping? discuss how key wrapping works and how can be easy to change user password without need to re-encrypt user's data.

I understand there is no problem when I'm changing password that I know - I know my password, original encrypt key is unwrapped and re-wrapped with new key derived from new password; so far so good.

Question1: How can be key-wrapping mechanism used when I forgot my password? (password is used to create wrapping key). I think that in this situation it cannot done and user's data are lost because I cannot unwrap original encrypt key so I cannot re-wrap original encrypt key. Am I right or wrong?

Question2: Is there some way / mechanism / technique how can I decrypt encrypted symmetric cipher key (AES) with two secret values? One value is derived from password / passphrase and second is from something as Apple's recovery key. I am studying paper Infiltrate the Vault: Security Analysis and Decryption of Lion Full Disk Encryption but I'm not done yet.
Question1: How can be key-wrapping mechanism used when I forgot my password? (password is used to create wrapping key). I think that in this situation it cannot done and user's data are lost because I cannot unwrap original encrypt key so I cannot re-wrap original encrypt key. Am I right or wrong?


This is right of course, if you cannot recover the key required for unwrapping then you cannot unwrap.


  Question2: Is there some way / mechanism / technique how can I decrypt encrypted symmetric cipher key (AES) with two secret values? One value is derived from password / passphrase and second is from something as Apple's recovery key.


Yes, of course you can. This is quite often performed. It is even possible to require N out of M parts to form or decrypt the final key in certain protocols.



The recovery key size should of course be at least 32 bytes if you want to remain on the same security level as AES-256. Then again, using keys derived from a password will normally not provide 256 bit security either.