Rehashing passwords without asking all users to ch

Question

A former developer used the PHP hash() function with the SHA256 algorithm to store password hashes. To improve the security of the system, I'd like to start using crypt() with the Blowfish algorithm (unfortunately we don't have PHP 5.5 and thus password_hash() is not available).

Since SHA256 is a non-reversible hashing algorithm, is there a way to start using crypt() with the salted passwords without asking everyone to reset their password?

Answer 1

There may be other faster and more efficient ways to do this, but if you want to do this without it affecting your users, this is how I would do it -

Add another column to your table, a basic flag that can go True or False. Default it to false. Then implement the following pseudocode :

if(flag=true)
{
 use crypt() and authenticate user
}
else
{
use hash() and authenticate user
use crypt() on the provided password (once authenticated)
update the record to put the new password into the table
set flag=true
}

Essentially it check if the password is updated or not, and updates it if it isn't. You can eventually take this function off, once your users have made the transition. But as it adds almost no load, I would recommend keeping it!

Its a bit roundabout, but it will have the minimal amount of work for your users to do, and it will run in the background without giving them any indication of it happening!