caching_sha2_password_digest_rounds

Overview

caching_sha2_password_digest_rounds specifies the number of SHA-256 iterations performed before a password is hashed and stored to disk when the caching_sha2_password authentication plugin is used.

Privilege requirements

• Query variables

  • Global level

    Both the sys tenant and all user tenants can use the SHOW VARIABLES statement, or the SYS.TENANT_VIRTUAL_GLOBAL_VARIABLE view (in Oracle-compatible mode) and the information_schema.GLOBAL_VARIABLES view (in MySQL-compatible mode), to view the values of global system variables.

• Modify variables

  • Global effective

    • The sys tenant can directly modify the values of global system variables.

    • MySQL user tenants must have the SUPER or ALTER SYSTEM privilege to modify the values of global system variables.

    • Oracle user tenants must have the ALTER SYSTEM privilege to modify the values of global system variables.

Attributes

Usage instructions

This variable controls the number of SHA-256 iterations performed before a password is hashed and stored to disk when using the caching_sha2_password authentication plugin. Increasing the number of iterations enhances password hash security but also increases the computational overhead for password verification. This variable allows users to balance security and performance. After modifying this variable, newly created passwords will use the new iteration count, but existing password hashes will not be affected.

Configuration example

Set the number of SHA-256 iterations for password hashing to 10000.

• Effective globally

  obclient> SET GLOBAL caching_sha2_password_digest_rounds = 10000;