SEC-2562: Modernize Password Storage

[spring-projects-issues]

Rob Winch (Migrated from SEC-2562) said:

Password storage has come a long ways and is a very important aspect of security. We should modernize how passwords are stored and managed.

A special thanks to John Steven for providing guidance on these recommendations.

Subtasks

• Add DelegatingPasswordEncoder #4666 - Add DelegatingPasswordEncoder
• SEC-2563: Make adaptive one-way functions the default scheme (BCrypt) #2775 - Make adaptive one-way functions the default scheme (BCrypt)
• SEC-1932: Provide a PBKDF2 PasswordEncoder implementation #2158 - Provide a PBKDF2 PasswordEncoder implementation
• SEC-2564: Deprecate all salted digest password encoding #2776 - Deprecate all salted digest password encoding
• SEC-2565: Incorporate Password Storage Scheme spec into stored format #2777 - Incorporate Password Storage Scheme spec into stored format
• SEC-2566: Support password storage upgrades #2778 - Support password storage upgrades
• SEC-2567: Formal audit of BCrypt implementation #2779 - Formal audit of BCrypt implementation
• SEC-2528: Support PBKDF2 SHA256 for JDK8+ #2742 - Support PBKDF2 SHA256 for JDK8+
• Support phc Password Storage #9833 Support phc Password Storage