[issue2551252] Modify default rounds for password_pbkdf2_default_rounds to match OSWAP

New submission from John Rouillard:

We use sha1 along with PBKDF2.
 
   https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2

recommends 720,000 iterations not 10000.

Change config default to 720,000.

Changing the default will not invalidate existing passwords hashes. They will still
be usable.

Existing passwords will still retain the 10000 iteration number.
Also because of issue 2551251, passwords will not be automatically re-encrypted when user
logs in via web interface.

----------
components: Web interface
keywords: Blocker, Effort-Low, StarterTicket
messages: 7699
nosy: rouilj
severity: normal
status: new
title: Modify default rounds for password_pbkdf2_default_rounds to match OSWAP
type: security

_________________________________________________
Roundup tracker <[email protected]>
<https://issues.roundup-tracker.org/issue2551252>
_________________________________________________