There's a long backstory here, but the short story is, I can't seem to get MySQL 8 and Dovecot to generate the same SHA256 hashes, given the same salt and password.

Update: It appears that SHA256-CRYPT does not just take the salt and append it to the password. It actually uses the salt and password in a moderately complicated way that requires the algorithm to have them as two distinct pieces, rather than one undifferentiated string (see this description of crypt written by one of the glibc maintainers), so I can't do the naive implementation I was trying below. Therefore, the question becomes, does MySQL have a user function that can access the CRYPT algorithms? I can't seem to find one; however, MySQL 8's actual user passwords now seem to use exactly that (see MySQL Server Blog, New Default Authentication Plugin, which leaves me hope that such a function does exist. Does it?

Old details below


$doveadm pw -s SHA256-CRYPT -p apassword                   

Then, I grab that salt (h1JEsg1tmnTGS9Ub), and try and get the same output from MySQL 8:

SELECT CONCAT('$5$', 'h1JEsg1tmnTGS9Ub', '$', TO_BASE64(UNHEX(SHA2(CONCAT('apassword', 'h1JEsg1tmnTGS9Ub'), 256)))) WHERE true

There have been several questions circling around this on here, but everyone seems to have decided to drop the salt and just use SHA512 unsalted. It seems to be that this should be easy, and yet ...

Anyone have any ideas on how to get MySQL 8 to generate the same hash as doveadm, with same password and salt?

FWIW, I've tried the MySQL with and without TO_BASE64 and with and without UNHEX (I believe in all combinations).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.