Since 11.6, MariaDB has a new authentication method, named parsec authentication, based in PBKDF2 authentication + (standard) ed25519 signature
This will be the default in a few version in the futur
Protocol description
documention here
authentication plugin data format :
string<32> server nonce
Client has to respond sending an empty packet to request "ext-salt".
Server respond with ext-salt.
format:
- string<1> 'P' (denotes KDF algorithm = PBKDF2)
- byte<1> iteration factor. number of iterations correspond to 1024 << iteration factor (0x0 means 1024, 0x1 means 2048, etc.)
- byte salt
Client response :
The client nonce is 32 random bytes
The signature is generated by :
- generate derived key = hash password with PBKDF2 ( sha512 digest) with iteration number and salt from ext-salt.
- generate the signature with ed25519 of an array concatenation of server nonce + client nonce with the generated derived key as private key.
Example of implementation :
additionally, this is one of the authentication method that can be trusted for SSL fingerprint validation
|
switch (m_currentAuthenticationMethod) |
Since 11.6, MariaDB has a new authentication method, named parsec authentication, based in PBKDF2 authentication + (standard) ed25519 signature
This will be the default in a few version in the futur
Protocol description
documention here
authentication plugin data format :
string<32> server nonce
Client has to respond sending an empty packet to request "ext-salt".
Server respond with ext-salt.
format:
Client response :
The client nonce is 32 random bytes
The signature is generated by :
Example of implementation :
)
additionally, this is one of the authentication method that can be trusted for SSL fingerprint validation
MySqlConnector/src/MySqlConnector/Core/ServerSession.cs
Line 638 in 158dce2