Package org.mariadb.jdbc.plugin.authentication.standard

Class ParsecPasswordPlugin

    • Field Summary

      Fields 
      Modifier and Type Field Description
      private java.lang.String authenticationData  
      private static int DEFAULT_CONNECT_BUDGET_MS
      Time budget used when connectTimeout is disabled (zero).
      private byte[] hash  
      private static int MAX_ITERATION_FACTOR
      Absolute ceiling, whatever the time budget: a factor of 22 would overflow the 1024 << iterations round count.
      private static long PBKDF2_REFERENCE_MS  
      private static long PBKDF2_REFERENCE_ROUNDS
      Deliberately conservative PBKDF2-HMAC-SHA512 throughput reference: 262144 rounds measured in 225ms.
      private byte[] seed  

    • Constructor Summary

      Constructors 
      Constructor Description
      ParsecPasswordPlugin​(java.lang.String authenticationData, byte[] seed)
      Initialization.

    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      private byte[] combineArray​(byte[] arr1, byte[] arr2)  
      (package private) static int connectBudgetMs​(int connectTimeout)
      Connection time budget the PBKDF2 hashing must fit in: the configured connectTimeout, or a default budget when connectTimeout is disabled (zero).
      byte[] hash​(Credential credential)
      Return Hash
      boolean isMitMProof()
      Can plugins are MitM-proof, permitting returning HASH
      (package private) static int maxIterationFactor​(int budgetMs)
      Maximum iteration factor a server may request, derived from the connection time budget.
      ReadableByteBuf process​(Writer out, Reader in, Context context, boolean sslFingerPrintValidation)
      Process parsec password plugin authentication.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Field Detail

      • PBKDF2_REFERENCE_ROUNDS

        private static final long PBKDF2_REFERENCE_ROUNDS
        Deliberately conservative PBKDF2-HMAC-SHA512 throughput reference: 262144 rounds measured in 225ms. Used to convert the connection time budget into a maximum iteration factor.
        See Also:
        Constant Field Values

      • DEFAULT_CONNECT_BUDGET_MS

        private static final int DEFAULT_CONNECT_BUDGET_MS
        Time budget used when connectTimeout is disabled (zero).
        See Also:
        Constant Field Values

      • MAX_ITERATION_FACTOR

        private static final int MAX_ITERATION_FACTOR
        Absolute ceiling, whatever the time budget: a factor of 22 would overflow the 1024 << iterations round count.
        See Also:
        Constant Field Values

      • authenticationData

        private final java.lang.String authenticationData

      • seed

        private final byte[] seed

      • hash

        private byte[] hash

    • Constructor Detail

      • ParsecPasswordPlugin

        public ParsecPasswordPlugin​(java.lang.String authenticationData,
                            byte[] seed)
        Initialization.
        Parameters:
        authenticationData - authentication data (password/token)
        seed - server provided seed

    • Method Detail

      • process

        public ReadableByteBuf process​(Writer out,
                               Reader in,
                               Context context,
                               boolean sslFingerPrintValidation)
                        throws java.sql.SQLException,
                               java.io.IOException
        Process parsec password plugin authentication. see parsec-plugin
        Specified by:
        process in interface AuthenticationPlugin
        Parameters:
        out - out stream
        in - in stream
        context - connection context
        sslFingerPrintValidation - true if SSL certificate fingerprint validation is enabled
        Returns:
        response packet
        Throws:
        java.io.IOException - if socket error
        java.sql.SQLException - if plugin exception

      • connectBudgetMs

        static int connectBudgetMs​(int connectTimeout)
        Connection time budget the PBKDF2 hashing must fit in: the configured connectTimeout, or a default budget when connectTimeout is disabled (zero).
        Parameters:
        connectTimeout - configured connect timeout, in milliseconds
        Returns:
        time budget in milliseconds

      • maxIterationFactor

        static int maxIterationFactor​(int budgetMs)
        Maximum iteration factor a server may request, derived from the connection time budget. The factor is an exponent: hashing costs 1024 << factor PBKDF2-HMAC-SHA512 rounds, which are computed before authentication completes, with no interruptible socket read in between. The bound therefore scales with connectTimeout: a client declaring a longer budget permits a larger factor (100ms→6, 2500ms→11, 10s→13, 30s→15).
        Parameters:
        budgetMs - connection time budget, in milliseconds
        Returns:
        maximum permitted iteration factor

      • hash

        public byte[] hash​(Credential credential)
        Return Hash
        Specified by:
        hash in interface AuthenticationPlugin
        Parameters:
        credential - Credential
        Returns:
        hash

      • combineArray

        private byte[] combineArray​(byte[] arr1,
                            byte[] arr2)