There's a third pattern forward, which is that you rehash the entire password database with a more secure (specifically, slower) hash plus new, secret salt. Th

There's a third pattern forward, which is that you rehash the entire password database with a more secure (specifically, slower) hash plus new, secret salt. This also means you have a chance to crack any improper salt/secret storage, such as provisioning into memory only. You will still need to do a password upgrade on login, but you at least have now made it a requirement that an attacker not only grab your database, but also a memory snapshot or disk snapshot.