8

I was reading upon some mysql internals, when going through the mysql.user table in the my mysql shell, I get

mysql> select * from mysql.user limit 1 \G
*************************** 1. row ***************************
                  Host: localhost
                  User: root
              Password: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B

The password is obviously hashed, but why does it begin with the star (asterisk)?

6

In addition to the password starting with an asterisk, here is algorithm for PASSWORD()

SET @plaintextpassword = 'whatever password you want';
SELECT CONCAT('*',UPPER(SHA1(UNHEX(SHA1(@plaintextpassword)))));

EXAMPLE

mysql> SET @plaintextpassword = 'whatever password you want';
Query OK, 0 rows affected (0.00 sec)

mysql> SELECT UPPER(SHA1(UNHEX(SHA1(@plaintextpassword)))) PWD_CREATION;
+------------------------------------------+
| PWD_CREATION                             |
+------------------------------------------+
| D09AF2704D843A5E4E84362830C7EC1CEA40DF8A |
+------------------------------------------+
1 row in set (0.00 sec)

mysql> SELECT PASSWORD(@plaintextpassword) PWD_FUNCTION;
+-------------------------------------------+
| PWD_FUNCTION                              |
+-------------------------------------------+
| *D09AF2704D843A5E4E84362830C7EC1CEA40DF8A |
+-------------------------------------------+
1 row in set (0.00 sec)

mysql>

I learned this algorithm long ago from Hashing Algorithm in MySQL PASSWORD()

14

Ok, found about this in the documentation itself.

This was a change introduced in mysql 4.1 so that the earlier password lengths of 16 characters and newer password lengths of 40 characters could be simultaneously supported. The Password column was made 41 bytes (chars) long, and the newer passwords would begin with a mandatory * to identify them.

From the documentation:

Password hashes in the 4.1 format always begin with a “*” character, whereas passwords in the pre-4.1 format never do.

  • That was my guess, too. But it does not hold water. They could have checked the length to see if it were new vs old password. – Rick James Apr 22 '15 at 21:04
  • 3
    @Rick James It certainly is possible to check the length, but there are arguments for use of the first character as a "flag" to allow future changes that might still use 40 characters but a different algorithm. – Monty Harder Apr 22 '15 at 21:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.