Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-34846

PARSEC authentication improvement

    XMLWordPrintable

Details

    • Task
    • Status: Open (View Workflow)
    • Major
    • Resolution: Unresolved
    • None
    • None
    • None

    Description

      Current parsec implementation decription has many steps :

      1. receiving an Authentication Switch Request packet with 'parsec' plugin type with a 32-byte server random scramble
      2. if the ext-salt was specified in the .my.cnf, the client skips to step 4, otherwise it sends the user name (and nothing else) to the server
      3. Server sends the ext-salt to the client
      4. Client sends the random 32-byte scramble, and the concat(server scramble, client scramble) ed25519-signed by a secret key generated from the PBKDF2(password, ext-salt)
      5. Server replies with "ok" or "acces denied"

      Sending an empty packet requesting to ext-salt is actually mandatory (if ext-salt is known by connector, and go directly to step 4, connection fails). But better than correct this bug, the best would be to skip this exchange : Authentication Switch Request's authentication plugin data field actually contains 32 bytes of data corresponding to server random scramble, but it would be better to have this scramble + ext-salt directly, avoiding one exchange.

      Attachments

        Issue Links

          Activity

            People

              nikitamalyavin Nikita Malyavin
              diego dupin Diego Dupin
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.