Class ParsecPasswordPlugin

java.lang.Object
org.mariadb.jdbc.plugin.authentication.standard.ParsecPasswordPlugin
All Implemented Interfaces:
AuthenticationPlugin
public class ParsecPasswordPlugin extends Object implements AuthenticationPlugin
Parsec password plugin

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    private final String
    authenticationData
     
    private static final int
    DEFAULT_CONNECT_BUDGET_MS
    Time budget used when connectTimeout is disabled (zero).
    private byte[]
    hash
     
    private static final int
    MAX_ITERATION_FACTOR
    Absolute ceiling, whatever the time budget: a factor of 22 would overflow the 1024 << iterations round count.
    private static final long
    PBKDF2_REFERENCE_MS
     
    private static final long
    PBKDF2_REFERENCE_ROUNDS
    Deliberately conservative PBKDF2-HMAC-SHA512 throughput reference: 262144 rounds measured in 225ms.
    private final byte[]
    seed
     

  • Constructor Summary

    Constructors
    Constructor
    Description
    ParsecPasswordPlugin(String authenticationData, byte[] seed)
    Initialization.

  • Method Summary

    Modifier and Type
    Method
    Description
    private byte[]
    combineArray(byte[] arr1, byte[] arr2)
     
    (package private) static int
    connectBudgetMs(int connectTimeout)
    Connection time budget the PBKDF2 hashing must fit in: the configured connectTimeout, or a default budget when connectTimeout is disabled (zero).
    byte[]
    hash(Credential credential)
    Return Hash
    boolean
    isMitMProof()
    Can plugins are MitM-proof, permitting returning HASH
    (package private) static int
    maxIterationFactor(int budgetMs)
    Maximum iteration factor a server may request, derived from the connection time budget.
    ReadableByteBuf
    process(Writer out, Reader in, Context context, boolean sslFingerPrintValidation)
    Process parsec password plugin authentication.

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • PBKDF2_REFERENCE_ROUNDS

      private static final long PBKDF2_REFERENCE_ROUNDS
      Deliberately conservative PBKDF2-HMAC-SHA512 throughput reference: 262144 rounds measured in 225ms. Used to convert the connection time budget into a maximum iteration factor.
      See Also:

    • PBKDF2_REFERENCE_MS

      private static final long PBKDF2_REFERENCE_MS
      See Also:

    • DEFAULT_CONNECT_BUDGET_MS

      private static final int DEFAULT_CONNECT_BUDGET_MS
      Time budget used when connectTimeout is disabled (zero).
      See Also:

    • MAX_ITERATION_FACTOR

      private static final int MAX_ITERATION_FACTOR
      Absolute ceiling, whatever the time budget: a factor of 22 would overflow the 1024 << iterations round count.
      See Also:

    • authenticationData

      private final String authenticationData

    • seed

      private final byte[] seed

    • hash

      private byte[] hash

  • Constructor Details

    • ParsecPasswordPlugin

      public ParsecPasswordPlugin(String authenticationData, byte[] seed)
      Initialization.
      Parameters:
      authenticationData - authentication data (password/token)
      seed - server provided seed

  • Method Details

    • process

      public ReadableByteBuf process(Writer out, Reader in, Context context, boolean sslFingerPrintValidation) throws SQLException, IOException
      Process parsec password plugin authentication. see parsec-plugin
      Specified by:
      process in interface AuthenticationPlugin
      Parameters:
      out - out stream
      in - in stream
      context - connection context
      sslFingerPrintValidation - true if SSL certificate fingerprint validation is enabled
      Returns:
      response packet
      Throws:
      IOException - if socket error
      SQLException - if plugin exception

    • connectBudgetMs

      static int connectBudgetMs(int connectTimeout)
      Connection time budget the PBKDF2 hashing must fit in: the configured connectTimeout, or a default budget when connectTimeout is disabled (zero).
      Parameters:
      connectTimeout - configured connect timeout, in milliseconds
      Returns:
      time budget in milliseconds

    • maxIterationFactor

      static int maxIterationFactor(int budgetMs)
      Maximum iteration factor a server may request, derived from the connection time budget. The factor is an exponent: hashing costs 1024 << factor PBKDF2-HMAC-SHA512 rounds, which are computed before authentication completes, with no interruptible socket read in between. The bound therefore scales with connectTimeout: a client declaring a longer budget permits a larger factor (100ms→6, 2500ms→11, 10s→13, 30s→15).
      Parameters:
      budgetMs - connection time budget, in milliseconds
      Returns:
      maximum permitted iteration factor

    • isMitMProof

      public boolean isMitMProof()
      Description copied from interface: AuthenticationPlugin
      Can plugins are MitM-proof, permitting returning HASH
      Specified by:
      isMitMProof in interface AuthenticationPlugin
      Returns:
      true if permitted

    • hash

      public byte[] hash(Credential credential)
      Return Hash
      Specified by:
      hash in interface AuthenticationPlugin
      Parameters:
      credential - Credential
      Returns:
      hash

    • combineArray

      private byte[] combineArray(byte[] arr1, byte[] arr2)