phpbb/phpbb3 — pull request #1716 by marc1706 (2013-09-14 12:31:52+00:00)
Title: [WIP][feature/passwords] Add password hashing manager with support for newer hashing algorithms

This PR will add a passwords manager to phpBB. It will take care of hashing and checking supplied hashes.
It has been made extensible to support newer hashing algorithms, namely bcrypt. Due to the interface design, this will make it possible to add even newer hashing algorithms in the future as they become available in PHP. Adding algorithms like pbkdf2 or scrypt shouldn't be an issue in the future.

A possible upgrade path for already existing passwords has been added. It is called "combined hashes". What this will basically due is hash the already existing hash (usually the salted md5 we use in 3.0) and hash it again with bcrypt. Both salts and hashing settings will be stored in one combined hash. While a bcrypt hash of a salted MD5 hash is not as secure as a pure bcrypt hash would be, this should significantly increase the hash security against bruteforce attempts compared to the old salted MD5 hashes.

Ticket: http://tracker.phpbb.com/browse/PHPBB3-11610