Problem

I'm teaching myself low-level networking, and have a project to replicate a MySql database. I have much of this working already, but have hit an issue where two different clients are producing different hash/scrambles for the same given password.

The two clients are:

1. Dbeaver, which uses the mysql JDBC driver
2. MySql workbench, which uses the libmsysqk driver

Info

As part of the server/client handshake, the server creates a 20-length scramble of random bytes, sent to the client to be used as a seed for producing a scrambled response. For the purposes of testing here, I fixed the 'random' scramble to the same sequence of bytes, so that I can get deterministic responses from the client.

For clarity below, the username and password in all cases is: admin:admin, and the authentication plugin used is caching_sha2_password (seen as such on both the server handshake and client response in all cases).

Given that we know the password and authentication method, we should be able to validate the password response scrambles from the client:

digest1 = SHA256( 'admin' )
digest2 = SHA256( digest1 )
digest3 = SHA256( serverScramble -concat- digest2 )
clientPasswordScramble = XOR( digest1, digest3 )

I'll also refer to the following sequences of (hex)bytes as:

scramble1: (20 byte 'random' payload send by the server)

1d 62 5b 72 75 3f 67 34 57 31 4e 39 4a 6e 03 01 5d 32 01 19 

scramble2: (20 byte 'random' payload send by the server)

5f 62 5b bc 14 3f 67 34 57 31 4e 39 4a 6e 03 01 5d 32 01 19

Testing

When sending scramble1, both clients respond the same with the same password scramble response:

45 16 10 ed 96 7d 6f d4 0a fe 2a bc d1 94 6a 57 59 f4 e5 47 4c ac 3b 34 fe fe 2b ee b7 58 bf 47

Given we know the steps to validate this (above), I know this to be the correct response.

However, when I change the server to send scramble2 instead, I get two different responses for the password.

Dbeaver response:

e5 ae ff d8 00 76 4d b2 6b a9 60 e2 9d 46 1a 2d ce 98 00 b6 14 b8 9a 38 1c 02 fa 09 0f cc 33 85

MySql Workbench response:

ac 59 ef 0b 9d 3b eb ad 2a 22 87 c5 ad 8c 5a 24 fe 88 0f 3b e8 b9 cf cd 21 75 0a 7b 2d cf 38 15

Again, using the same steps above to validate: the MySql Workbench response seems to validate fine, but the response given by dbeaver appears to be incorrect.

What is causing this discrepancy?

I believe I've given enough information above to reproduce the issue, but I'm happy to provide the server/client packets as captured from Wireshark if more is required.