in reply to Adjust bcrypt cost to prevent future password hash attacks

Just store the cost along with the salt and the hash.

Have the user change his password the next time he logs in after you increase the cost.

sub set_passwd { my ($user, $passwd) = @_; my $cost = COST; my $salt = _get_random_salt(); _set_passwd($user, "$cost:$salt:$passwd); } sub check_passwd { my ($user, $submitted_passwd) = @_; my ($cost, $salt, $passwd) = split /:/, _get_passwd($user); return hash($submitted_passwd, $salt, $cost) ne $passwd; } sub is_passwd_expired { my ($user) = @_; my ($cost, $salt, $passwd) = split /:/, _get_passwd($user); return $cost != COST; }