How to upgrade a password storage scheme (change hashing-algorithm)

Jacco_22674 0
Viewed 5494

I've been asked to implement some changes/updates to an intranet-site; make it 'future proof' as they call it.

We found that the passwords are hashed using the MD5 algorithm. (the system has been around since 2001 so it was adequate at time).
We would now like to upgrade the hashing-algorithm to a stronger one (BCrypt-hash or SHA-256).

We obviously do not know the plaintext-passwords and creating a new password for the userbase is not an option*).

So, my question is:

What is the accepted way to change hashing-algorithm without having access to the plaintext passwords?
The best solution would be a solution that is entirely 'behind the scenes'.

*) we tried; tried to convince them, we used the argument of 'password age', tried to bribe them with coffee, tried to bribe them with cake, etc. etc. But it is not an option.

Update
I was hoping for some sort of automagic solution for solving the problem, but apparently there are no other options than just 'wait for the user to log in, then convert'.

Well, at least now I now there is no other solution available.

password-hash password-protection security
7 Answers

The best answer is from an actual cryptography expert https://paragonie.com/blog/2016/02/how-safely-store-password-in-2016#legacy-hashes

This post also helps explain which hashing you should use. It's still current even if it says 2016. If in doubt use bcrypt.

Add a column to your user accounts table, called legacy_password (or equivalent). This is just a Boolean

Calculate the new stronger hash of the existing password hashes and store them in the database.

Modify your authentication code to handle the legacy flag.

When a user attempts to login, first check if the legacy_password flag is set. If it is, first pre-hash their password with your old password hashing algorithm, then use this prehashed value in place of their password. Afterwards (md5), recalculate the new hash and store the new hash in the database, disabling the legacy_password flag in the process.

user_115587990
Related