Re: [vwrap] authentication : remove reference to MD5

[Barry Leiba <[e-mail]>]

> so if we simply said "we're going to ditch MD5 in favor of SHA256"
> there would be a problem with reverse compatibility of the
> authentication data. this is because you can't generate the pre-image
> from an MD5 MIC and then use it to generate a SHA256 MIC. (or you
> can't do that in a way that insures that your MD5 pre image is the
> same as the password.)

The usual way to handle this is with a migration process.  Credentials
are re-hashed with the new algorithm when they're changed, over time.
After a time, there's a cutoff and users are forced to change their
credentials the next time they log in.  The old login has to be
supported as long as there are users who have not yet changed... or
until someone decides to toss those users.

Barry