mysql_sha256_password doesn't use the nonce system which is used for
mysql_new_password, but instead forces the use of RSA or SSL.
This is how that works:
- The client connects
- The server changes authentication to sha256 password (or default?)
- The server sends the RSA public key.
- The client encrypts the password with the RSA public key and sends it to the server.
- The server decrypts the password with the private key and validates it.
The problem is that the client trusts public key of the server. It is possible to use
--server-public-key-path=file_name. But then you need to take care of secure public key distribution yourself.
So if we put a proxy between the client and the server and then have the proxy sent its own public key... then we can decrypt it and reencode it with the real public key and send it to the server. Also the decrypted password is the password, not a hash. So we then know the real password.
And if SSL is used it doesn't do the RSA encryption... but this can be a connection with an invalid certificate. Just anything as long as the connection is SSL.