Here's the new table to help administrators understand hashing:

{F115237}

I was going to ask "why?" Then I had the fun read of T4443. You sir are quite kind to existing installs re: php extensions. :)

Gave this a quick read-through; looks well-designed to handle corner cases such as moving to an install that has fewer hashers available, etc.

Yeah, on the one hand this is sort of overkill. If we had reasonable access to bcrypt in PHP 5.2.3 without extensions I would probably just switch all new hashing over and then opportunistically migrate the md5 stuff. However, we don't have convenient access until 5.5.0, and have no non-extension access to scrypt.

In defense of the complexity involved here, the underlying problem really is a migration problem (i.e., the cost factor of the hashing algorithm should theoretically be keeping pace with the speed of hardware), and this isn't that complex, and lets us reframe the problem completely as a migration problem: you specify the best algorithm, and everything moves toward it on average. After D8271, we can bump the cost factor every couple of years with one line of code.

I like all the transparency this brings around algorithms, too. And we can also share all this code in the VCS password stuff (coming shortly).