[PECL-DEV] mysqlnd authentication plugin: mysqlnd_ed25519

--000000000000ee1aa1063aa8d66c
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

I would like to upload a new package for mysqlnd ed25519 authentication to
PECL

Currently, PHP can only connect to MariaDB servers using the
mysql_native_password authentication plugin, which relies on SHA-1. SHA-1
is considered insecure, as noted in RFC 6194, 9155, 9157, RFC 9157, NIST SP
800-131A, etc.

This module provides an authentication plugin (ed25519) that uses libsodium
for authentication, allowing PHP clients to authenticate against MariaDB
servers using Ed25519 instead of SHA-1.

The new package, mysqlnd_ed25519, is currently hosted here:
https://github.com/9EOR9/mysqlnd_ed25519.git

Also support for the MariaDB PARSEC authentication plugin is planned.
However, implementing it requires additional round trips, and the current
mysqlnd plugin API does not seem to support multiple round trips without
accessing mysqlnd=E2=80=99s internal functions. If anyone has experience
implementing a mysqlnd authentication plugin that requires extra round
trips, I would greatly appreciate advice or examples.

Please let me know if there are any objections to uploading this to PECL or
if you have questions or suggestions.

About me:

I am a member of MariaDB=E2=80=99s Connector team and a retired author/main=
tainer
of PHP=E2=80=99s mysql, mysqli, mysqlnd, and ncurses extensions, as well as=
 a
retired member of the PHP documentation team.

Best regards,
Georg Richter

--=20
Georg Richter, Staff Software Engineer
Client Connectivity
MariaDB Corporation Ab

--000000000000ee1aa1063aa8d66c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi,<br><br>I would like to upload a new package for m=
ysqlnd ed25519 authentication to PECL<br><br>Currently, PHP can only connec=
t to MariaDB servers using the mysql_native_password authentication plugin,=
 which relies on SHA-1. SHA-1 is considered insecure, as noted in RFC 6194,=
 9155, 9157, RFC 9157, NIST SP 800-131A, etc.<br><br>This module provides a=
n authentication plugin (ed25519) that uses libsodium for authentication, a=
llowing PHP clients to authenticate against MariaDB servers using Ed25519 i=
nstead of SHA-1.</div><div><br></div><div>The new package, mysqlnd_ed25519,=
 is currently hosted here: <a href=3D"https://github.com/9EOR9/mysqlnd_ed25=
519.git">https://github.com/9EOR9/mysqlnd_ed25519.git</a></div><div><br></d=
iv><div>Also support for the MariaDB PARSEC authentication plugin is planne=
d. However, implementing it requires additional round trips, and the curren=
t mysqlnd plugin API does not seem to support multiple round trips without =
accessing mysqlnd=E2=80=99s internal functions. If anyone has experience im=
plementing a mysqlnd authentication plugin that requires extra round trips,=
 I would greatly appreciate advice or examples.<br><br>Please let me know i=
f there are any objections to uploading this to PECL or if you have questio=
ns or suggestions.<br><br>About me:<br><br>I am a member of MariaDB=E2=80=
=99s Connector team and a retired author/maintainer of PHP=E2=80=99s mysql,=
 mysqli, mysqlnd, and ncurses extensions, as well as a retired member of th=
e PHP documentation team.<br><br>Best regards,<br>Georg Richter</div><br><s=
pan class=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr" class=
=3D"gmail_signature" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><d=
iv><div dir=3D"ltr"><div>Georg Richter, Staff Software Engineer</div><div>C=
lient Connectivity<br></div><div>MariaDB Corporation Ab<br></div></div></di=
v></div></div></div>

--000000000000ee1aa1063aa8d66c--