4 ms·

I am on md5 on one of my projects but it's salted alright. I want to change it. I reckon there is no way to migrate other than resetting every user password.

by Achshar 13y ago

Jeremy1026 13y ago
Actually, you can migrate slowly. Create a second password column on your database to store your new hash. When a user logs in check if the new column is blank. If it is check that they entered the password correctly by verifying against your MD5 hash. If it is correct rehash their plain text and store it in the new column. If the new column isn't blank, then the have already logged in and you have the new hash, so verify against the new hash. As everyone logs into your website, you'll have a new set of, more secure, hashes. For those that are inactive you can either delete them, assign a random password and email them, or let their MD5 password hash sit there forever.
- DoubleMalt 13y ago
  Don't forget to delete the value in the md5 column, otherwise the whole exercise is for naught.
  - Jeremy1026 13y ago
    Correct.
pilif 13y ago
You could add a second password column to your users. Then if that column is empty, authenticate against the old password. If it passes, hash the password (just supplied by the user) with bcrypt and store it in the new column. Over time, active users get their password upgraded. Then after a longer time, just reset the passwords of the users who never logged in since you started migrating.
- byroot 13y ago
  You can even do simpler. On signup store: $password = password_hash(md5($password),PASSWORD_BCRYPT); And on login: password_verify(md5($password), $password_hash); Then you just have apply password_hash() on all you passwords in database. Bonus the migration is instantaneous, you don't need a 6 month transition period. IMHO it do not reduce the security, but i'm not a crypto expert though.
  - Jeremy1026 13y ago
    It does add extra computational power to your log in though. While it is a minimal amount, depending on the size of your application it could be notable.
    - byroot 13y ago
      There is no way that it become notable. bcrypt is precisely designed to be slow and greedy in computational power. So adding an extra md5 hashing is totally insignificant (in term of computation).

I am on md5 on one of my projects but it's salted alright. I want to change it. I reckon there is no way to migrate other than resetting every user password.

by Achshar 13y ago

I am on md5 on one of my projects but it's salted alright. I want to change it. I reckon there is no way to migrate other than resetting every user password.

Jeremy1026 13y ago

Actually, you can migrate slowly. Create a second password column on your database to store your new hash. When a user logs in check if the new column is blank. If it is check that they entered the password correctly by verifying against your MD5 hash. If it is correct rehash their plain text and store it in the new column. If the new column isn't blank, then the have already logged in and you have the new hash, so verify against the new hash. As everyone logs into your website, you'll have a new set of, more secure, hashes. For those that are inactive you can either delete them, assign a random password and email them, or let their MD5 password hash sit there forever.

DoubleMalt 13y ago
Don't forget to delete the value in the md5 column, otherwise the whole exercise is for naught.
- Jeremy1026 13y ago
  Correct.

pilif 13y ago

You could add a second password column to your users. Then if that column is empty, authenticate against the old password. If it passes, hash the password (just supplied by the user) with bcrypt and store it in the new column. Over time, active users get their password upgraded. Then after a longer time, just reset the passwords of the users who never logged in since you started migrating.

byroot 13y ago
You can even do simpler. On signup store: $password = password_hash(md5($password),PASSWORD_BCRYPT); And on login: password_verify(md5($password), $password_hash); Then you just have apply password_hash() on all you passwords in database. Bonus the migration is instantaneous, you don't need a 6 month transition period. IMHO it do not reduce the security, but i'm not a crypto expert though.
- Jeremy1026 13y ago
  It does add extra computational power to your log in though. While it is a minimal amount, depending on the size of your application it could be notable.
  - byroot 13y ago
    There is no way that it become notable. bcrypt is precisely designed to be slow and greedy in computational power. So adding an extra md5 hashing is totally insignificant (in term of computation).