1

PHP (and by extension WordPress) only supports MySQL native & sha256 password authentication.

MariaDB Server only supports MySQL native & ed25519 password authentication.

Since MySQL native password authentication uses SHA-1 and is not considered secure anymore, there is no actual secure way to use the MariaDB server with PHP.

Am I missing something here?

9
  • Are you interested in how the password to the database server is hashed? Or how passwords of wordpress users stored in the database are hashed?
    – Anders
    Aug 11, 2021 at 17:25
  • I suspect you conflate the database connection and it’s authentication, with the web applications password. If you are worried about the database connection, that supports a much wider array of authentication schemes than what you listed here (like host based & X509). The web app has nothing to do with how the DBMS stores stuff, it just cares with how it supplies and retrieved the data.
    – LvB
    Aug 11, 2021 at 18:08
  • Im concerned with how the passwords to the db server is hashed, not how wordpress stores them in a db record. Obv. the passwords for wordpress users arent dependent on the hashing that the db authentication supports. Aug 12, 2021 at 12:49
  • I understand that the webapp has nothing to do with how the DBMS stores stuff, I mean that WordPress is PHP-based, and PHP connects to the DBMS and only supports native password authentication (SHA-1). Which is insecure and not recommended anymore. Aug 12, 2021 at 12:50
  • I know that I can enforce SSL encryption for the connections using REQUIRE SSL or REQUIRE X509, but that doesn't change that the hashing supported between PHP and MariaDB server is still SHA-1. You arent suggesting that its okay if MariaDB only used MD5 hashing for authentication because you can force SSL on the connection, are you? Aug 12, 2021 at 12:53

1 Answer 1

0

I guess the answer is, Yes, MariaDB should not be used for any PHP application until either PHP supports ed25519 password authentication and/or MariaDB Server supports sha256 password authentication.

1
  • Update in Jan 2022: MariaDB Server is still inadvisable to use for any project involving PHP as you are forced to use mysql_native_password which uses SHA-1 hashing. Release notes for MariaDB Server 10.6/10.7/10.8 do not list sha256 password authentication support. Also, PHP has not added support for ed25519 password authentication through its mysql connectors. Jan 27, 2022 at 16:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .