This question already has an answer here:
This is a hypothetical situation, not one I am currently in.
Suppose I'm using some hash function, call it H1, which is considered relatively safe currently to store passwords. I'm also using a salt. If tomorrow the hash function will be considered compromised (or something to that effect), as happened with SHA1, what should I do to re-secure the passwords?
Naively, I would like to reconstruct the passwords hashed with H1 and rehash them with a relatively safe other hash function, H2. But, of course, this is impossible since the whole point was to not be able to reconstruct the passwords. I was thinking about 2 possible courses of action:
- Hash with H2 the H1-hashes. Now in order to authenticate the user I would have to hash with H1 and then H2 and compare. This basically treats the H1 hashes as plaintext passwords albeit more annoying for the attacker. In this scenario, would one need another salt for H2 or can the one from H1 be reused?
- Immediately revoke the stored passwords and email/text (or any 2nd authentication method) users a temporary password which has to be replaced with a new one upon the next login, the latter hashed with H2 and salted with a new salt.
Comparing them, it seems to me that 1 has the advantage of not involving humans and not relying on a 3rd party channel, although resetting passwords this way seems fairly common. It has the disadvantage of additional clutter and work required to authenticate.
Are one of the above 2 considered the correct course of action, or something else is?