Connecting via sha256_password

The sha256_password plugin manages authentication using SHA-256 encryption, supporting both clear text passwords over SSL and RSA encrypted password exchange.

Overview

SHA256 authentication possible exchanges:

• If connection uses SSL (SSLRequest Packet sent):

  • Client sends a clear password answer.

• Else:

  • If client doesn't know server RSA public key:

    • Client sends a public key request.

    • Server sends a public key response.

  • Client sends an RSA encrypted password.

  • Ends with server sending either OK_Packet , ERR_Packet.

Authentication

Client Clear Password Answer

• string<NUL> password without encryption.

Public Key Request

• byte<1> fixed 0x01 value.

Public Key Response

• byte<1> fixed 0x01 value.

• byte<EOF> public key data.

RSA Encrypted Password

• byte<256> RSA encrypted password.

RSA encrypted value of XOR(password, seed) using server public key (RSA_PKCS1_OAEP_PADDING).

_{This page is licensed: CC BY-SA / Gnu FDL}