[issue2551251] re-encrypt PBKDF2 password with password_pbkdf2_default_rounds if prior password used a different number of rounds.

New submission from John Rouillard:

If the admin changes password_pbkdf2_default_rounds in config.ini, the encrypted password
is not updated to the new count when they login to the web interface.

This case should be handled as though an insecure password encryption was used and 
migrate_passwords is set to yes.


It looks like this can be done by making password.py:Password::needs_migration
check the number of rounds is < password_pbkdf2_default_rounds. Also change signature
of needs_migration to accept config argument so method can check against the
password_pbkdf2_default_rounds setting.

----------
components: Database
keywords: Effort-Low
messages: 7697
nosy: rouilj
severity: normal
status: new
title: re-encrypt PBKDF2 password with password_pbkdf2_default_rounds if prior password used a different number of rounds.
type: security

_________________________________________________
Roundup tracker <[email protected]>
<https://issues.roundup-tracker.org/issue2551251>
_________________________________________________