Hi Roger,
Sounds like its trying to decrypt a password that isn't encrypted or possibly one that was encrypted with a different machine key. I would look in the db and see if it looks like an encrypted password or not.
Is this happening on just one user or on all users?
When you upgraded you got the new web.config file. If your old Web.config file had a custom machinekey then you need to restore it from your old web.config. If the machine key changes it can't decrypt anything that was encrypted with the old key so its important never to change your machine key.
There is a known bug when you create a new site it fails to encrypt the new site admin's password, so you should create the site with plain text password format and then after its created you can change it to encrypted and will encrypt it correctly that way. This bug isalready fixed in svn.
Hope it helps,
Joe