Re: Why SHA256+salt authentication ?

Sergei Golubchik skrev 2011-05-27 11:24:
> Just curious, why do you guys want new authentication plugin
> that uses sha256 and salt?

It is important to realize that this code is just a prototype on
something which we're discussing. The immediate plans for this in future
releases are not settled nor guaranteed. But from a pure technical stand
point I think it is important to invite more people to discussion in the
spirit of open source.

So why make a prototype? There is a driving demand to leave SHA-1 based
algorithms behind and start using SHA-2 based algorithms. There is a
proof of concept on attacking SHA-1 which are a year or two old, but I
haven't found anything similar to an exploit though. On the other hand,
it is important to be ahead of the game in the land of cryptography.

> 
> Was the current (double SHA2) security found flawed?

There is no evidence that it is flawed and there is no evidence of
successful cryptographic attacks.

> Or you just like it salted?

Yes. It is suppose to make it more difficult to construct MySQL specific
rainbow tables.

> 
> Or (conspiracy theory) it's a way to prevent open source MySQL clients
> (or servers) to talk to commercial MySQL servers (or clients)?
> No, it doesn't look like it.
> 

Nope. We both want everyone to use MySQL, even paranoid governments with
a cryptographic fetish, wouldn't you agree? :)

Regards,
Kristofer

-- 
MySQL Internals Mailing List
For list archives: http://lists.mysql.com/internals
To unsubscribe:    http://lists.mysql.com/[email protected]