If I have an application that is using a less secure method for storing passwords, such as SHA-1, how would I go about converting to SHA-256 or SHA-512?
You mean something like a web application that is storing hashes rather than password for login? You won't be able to convert the SHA-1 hashes to anything else very easily.
You could store the new SHA value in your database as users log in, updating each user as they present their correct password, either making a marker in the users table as to what kind of hash their password is stored as, or just trying them in a preferred sequence. New login would look something like this:
- Hash the password with the preferred hash
- Authenticate, if correct, log in the user
- If not correct, try hashing with sha1 instead. If this is correct, update the database with the preferred password and log the user in.
Simply update your table to indicate which encryption method is used and force users to change their password after next login. They can even reuse the existing password, but then you can indicate in your table which method the password has was created with.
(Expanding upon what Collin and MainMa wrote..) Add a column to the table for the SHA-512 hashes. During the login process, see whether the SHA-1 or SHA-512 field is populated for the user. Validate using that field. If the field is SHA-1 instead of 512, display some screen describing "new security features" and ask them to input the same or a new password. Store this hashed password in the SHA-512 column and remove the SHA-1 value. Keep this logic until all users are using SHA-512.