Magento 1.9 doesn't recognize old password with two characters salt

Question

After some issues, I've correctly upgraded to magento 1.9.1.1

Now any users (customers and admin) can't anymore login in frontend or backend. They always get the "Invalid User Name or Password" error. Some days ago I've opened a question about the same problem that was marked as duplicate of this one. After some more investigation I can trustily say that it's not.

My current situation is that all the passwords saved before the upgrade from magento 1.6 to magento 1.9 are still registered with two character salt.
Despite from magento 1.8 the salt is made by 32 character, magento should still accepts old password.
In my case it doesn't happen and magento trigger the user/password error if the password has a two character salt.

Has I've described this is a totally different scenario from the one of the "duplicated" question (where 2 character salt are accepted but 32 character salt are not correctly created due to db misconfiguration).

I'm pretty sure the issue is due to the salt problem I've described and not relate to cache, cookie and so one. Customers registered after the upgrade have no problem and if I manually regenerate old pw with 32 character salt it works fine...
I really have no idea why my magento install works this way but I can't ask to thousands of clients to reset their passwords. After some days of thinking I'm still without any possible answer. I'll really appreciate any advice.

Answer 1

At the end of the day I've figured this out!

I have noticed that old password hashes stored in the database (the part before ":salt") where longer than the new password generated after the upgrading.

Thanks to this article (that explains how and where magento make and check password) I have discovered that the Magento install I'm working on was customized by someone in the past.

In our Mage_Core_Model_Encryption hash is not generated like default:

public function hash($data) 
{
    return md5($data);
}

but returning hash('someCustomString', $data) After the upgrade I loose this customisation and the standard pw check obviously fail.

Now I have re-customized the upgraded Magento and pw work again!

I hope this could be useful for someone else.