I have an issue trying to add security-gem features to an app that already has device for login and password management.

The objective is to be able to have the password expire and to deny the possibility for users to repeat passwords. Im able to have the password expire after the expiration period set on the config/initializers/devise-security.rb but It doesn’t not detect when a user repeats a password.

here is the device-security.rb

Devise.setup do |config|
  config.expire_password_after = 3.months
  config.password_archiving_count = 5
  config.deny_old_passwords = true # will deny all the old passwords
end

User model has :password_expirable, :password_archivable

After some debugging I noticed that the method password_archive_included? returns false when it loops through the old_passwords table and by debugging a bit more the method valid_password? throws a BCrypt::Errors::InvalidHash: invalid hash when it tries to decrypt the encrypted password stored on the old_passwords table. I fear it is because the config/initializer/device.rb contains:

config.encryptor = :restful_authentication_sha1

I have a ton of users so I can’t just change the device.rb to the bcrypt or change all the encrypted_password in the users table. Can someone help me here please? let me know if my problem description is understandable.

old_passwords table: