I have a legacy system currently storing unsalted MD5 passwords. Unfortunately, some other controls are not in place (like the ability to expire passwords) and I'm trying to upgrade my algorithm to something newer and avoid prompting the user for a new password.
I am wondering what the impact will be if I just use something like a bcrypt on the current MD5 hash. In other words:
- User submits clear text password
- Password is hashed using MD5
- MD5 hash is hashed using bcrypt
- Hashes compared for authentication purposes
Is this going to "lessen" the strength of the resulting bcrypt hash somehow?