I don't believe the length is a major issue. It's "upgrading" references to a new hashing algorithm that's the issue. If for some reason length was an issue,

I don't believe the length is a major issue. It's "upgrading" references to a new hashing algorithm that's the issue. If for some reason length was an issue, a base64 encoded 256 bit string, like a SHA-256 digest, is 43 characters. That too can be truncated to 40 characters, which has 238 bits of security. SHA-256 is not only a better hashing algorithm than SHA-1 but it could also result in higher effective security even when truncated.