Update field-masking.md for version 3.x (#9395)

* Update field-masking.md for version 3.x

Signed-off-by: Terry Quigley <[email protected]>

* Update field-masking.md for version 3.x

Signed-off-by: Terry Quigley <[email protected]>

---------

Signed-off-by: Terry Quigley <[email protected]>

Author: terryquigleysas

_security/access-control/field-masking.md

@@ -79,11 +79,16 @@ See [Create role]({{site.url}}{{site.baseurl}}/security/access-control/api/#crea
 
 By default, the Security plugin uses the BLAKE2b algorithm, but you can use any hashing algorithm that your JVM provides. This list typically includes MD5, SHA-1, SHA-384, and SHA-512.
 
-You can override the default algorithm in `opensearch.yml` using the option default masking algorithm setting `plugins.security.masked_fields.algorithm.default`, as shown in the following example:
+You can override the default algorithm in `opensearch.yml` using the optional default masking algorithm setting `plugins.security.masked_fields.algorithm.default`, as shown in the following example:
 
 ```yml
 plugins.security.masked_fields.algorithm.default: SHA-256
 ```
+OpenSearch 3.x contains a bug fix to apply the default BLAKE2b algorithm correctly. You can override the default algorithm in OpenSearch 3.x to continue to produce the same masked values as OpenSearch 1.x and 2.x  in `opensearch.yml` using the optional default masking algorithm setting `plugins.security.masked_fields.algorithm.default`, as shown in the following example:
+
+```yml
+plugins.security.masked_fields.algorithm.default: BLAKE2B_LEGACY_DEFAULT
+```
 
 To specify a different algorithm, add it after the masked field in `roles.yml`, as shown in the following: