Migration Challenges and Strategies

Organizations using MD5 or SHA family algorithms for passwords face complex migration challenges. Simply switching to a secure algorithm would invalidate all existing passwords, requiring mass password resets that frustrate users and overwhelm support systems. This user experience concern often delays necessary security improvements, leaving systems vulnerable for extended periods.

A practical migration strategy involves transparent hash upgrading. When users log in with correct passwords, systems can verify against the old hash, then immediately rehash with a secure algorithm. This approach gradually migrates active users without disruption. For inactive accounts, forcing password resets on next login ensures eventual migration while maintaining security for active users.

import hashlib
import bcrypt

class PasswordMigrationSystem:
    """Example system for migrating from SHA-256 to bcrypt"""
    
    def __init__(self):
        self.users = {}  # Simulated user database
        
    def add_legacy_user(self, username, password):
        """Add user with legacy SHA-256 hash"""
        legacy_hash = hashlib.sha256(password.encode()).hexdigest()
        self.users[username] = {
            'hash': legacy_hash,
            'algorithm': 'sha256'
        }
    
    def authenticate_and_upgrade(self, username, password):
        """Authenticate user and transparently upgrade hash if needed"""
        if username not in self.users:
            return False
        
        user = self.users[username]
        
        if user['algorithm'] == 'sha256':
            # Verify against legacy hash
            legacy_hash = hashlib.sha256(password.encode()).hexdigest()
            if legacy_hash == user['hash']:
                # Correct password - upgrade to bcrypt
                new_hash = bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt())
                self.users[username] = {
                    'hash': new_hash,
                    'algorithm': 'bcrypt'
                }
                print(f"Successfully upgraded {username} from SHA-256 to bcrypt")
                return True
            return False
            
        elif user['algorithm'] == 'bcrypt':
            # Verify against bcrypt
            return bcrypt.checkpw(password.encode('utf-8'), user['hash'])
        
        return False

# Demonstration
system = PasswordMigrationSystem()
system.add_legacy_user("alice", "password123")

print("First login (with migration):")
system.authenticate_and_upgrade("alice", "password123")

print("\nSecond login (already migrated):")
system.authenticate_and_upgrade("alice", "password123")