Proposed changes to user management in MySQL 5.7

In May we proposed deprecating and removing the old password format in MySQL 5.7. I am happy to report, that this proposal has gone ahead, and can already be seen in the 5.7 DMR5 release notes!

With old passwords removed, and with recent versions of MySQL also offering new options for authenticating to MySQL, today I wanted to write about three additional proposed changes that follow suit:

1. Deprecate the PASSWORD() function

   As we already support multiple authentication methods (and may desire additional in the future), calling the PASSWORD() function to generate a password hash has a strange user experience.

   What I mean by this, is that PASSWORD() is not able to determine what hash format to generate without knowing the user’s authentication method. i.e.

   mysql [localhost] {msandbox} (mysql) > select user,host,password,plugin from mysql.user;
   +------------+-----------+-------------------------------------------+-----------------------+
   | user       | host      | password                                  | plugin                |
   +------------+-----------+-------------------------------------------+-----------------------+
   | root       | localhost | *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29 | mysql_native_password |
   | sha256user | localhost | $5$;Uq=HtOa2X:GRS$qKn9rc0xhh4rq3XKz | sha256_password       |
   +------------+-----------+-------------------------------------------+-----------------------+
   2 rows in set (0.00 sec)
   

   In current releases of MySQL there exists a variable called old_passwords which can hint at which plugin should be used. This creates a usability issue, since having a ‘back door’ influence the return value of a function is not very intuitive:

   mysql> select password('test'); /* mysql_native_password */
   +-------------------------------------------+
   | password('test')                          |
   +-------------------------------------------+
   | *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29 |
   +-------------------------------------------+
   1 row in set (0.00 sec)
   mysql> set old_passwords=1; /* old passwords */
   Query OK, 0 rows affected (0.01 sec)
   mysql> select password('test');
   +------------------+
   | password('test') |
   +------------------+
   | 378b243e220ca493 |
   +------------------+
   1 row in set (0.00 sec)
   mysql> set old_passwords=2; /* sha256_password */
   Query OK, 0 rows affected (0.00 sec)
   mysql> select password('test');
   +----------------------------------------------------------------------+
   | password('test')                                                     |
   +----------------------------------------------------------------------+
   | $5$HN
   wN_=@;`|uzm//b$uxYgsCdA.Y/35HKXtb/DhHceH78G8QSjBA/GPfxVH70  |
   +----------------------------------------------------------------------+
   1 row in set (0.01 sec)
   

   A more consistent usage would be password(password_string, auth_plugin), but we believe we have a more intuitive solution than this (see #3) and are proposing to deprecate the use of the PASSWORD() function in MySQL 5.7.

2. Deprecate the old_passwords variable

   The old_passwords variable was originally designed to be a boolean, and offer a way to restore old password hash generation. Starting with MySQL 5.6, this has been repurposed to have 3 possible values:

   • 0 = mysql_native_password (4.1 and above)
   • 1 = mysql_old_password (legacy format, removal in 5.7)
   • 2 = sha256_password (5.6 and above)

   Since we will be removing support for what is called “the old password hash” in MySQL 5.7, this makes the name choice of this variable somewhat confusing. While we could rename the variable to auth_plugin (or similar), the variable won’t actually be required, provided that the PASSWORD() function no longer requires a ‘back door’ variable as described above.

   We are proposing to deprecate the variable old_password in MySQL 5.7.

3. Deprecate the syntax SET PASSWORD .. = PASSWORD()

   The last piece of this proposal is to change the syntax for setting a user’s password
   to eliminate the use of the PASSWORD() function. The current syntax is:

   
mysql> SET PASSWORD = PASSWORD('test');
mysql> SET PASSWORD FOR 'sha256user'@'localhost' = PASSWORD('test');


   We are proposing that this be changed to:

   
mysql> SET PASSWORD = 'test'; /* raw password */
mysql> SET PASSWORD FOR 'sha256user'@'localhost' = 'test'; /* raw password */


   With the new syntax, we will always know the user’s account which we are operating on and consequently be able to apply the hashing function which applies to their authentication plugin.

   Further more, it will encourage users to reduce usage of copying password hashes from one account to another (although inserting/updating hashes in the raw mysql.user table will still be supported).

   We are aware that using password hashes is a way of obfuscating a password locally on the client so that it does not need to be sent over the wire, but we believe we have a superior solution to this in TLS.

We are seeking feedback from the community in regards to these proposed changes:

• Do you agree that setting a variable before calling the PASSWORD() function causes a usability issue?
• Would you agree that the syntax SET PASSWORD = 'test'; is more intuitive?
• In the case of the SET PASSWORD syntax no longer accepting hashes but instead passwords, do you agree that it is reasonable to require users use TLS for safe password changes? An alternative to TLS is to make changes locally via unix socket or via named pipe.

Please leave a comment, or get in touch!