An attack on MySQL's login protocol

Ivan Arce, Emiliano Kargieman, Gerardo Richarte +2

The MySQL challenge-and-response authentication protocol is proved insecure. We show how can an eavesdropper impersonate a valid user after witnessing only a few executions of this…