MySQL 9.0 Enforces caching_sha2_password as Default Authentication, Deprecates mysql_native_password

Starting with MySQL 9.0, the mysql_native_password authentication plugin is completely removed, and caching_sha2_password is enforced as the default authentication method. This is the final step following the change to the default in MySQL 8.0, requiring environments previously using mysql_native_password to prepare for migration before upgrading.

caching_sha2_password is based on the SHA-256 algorithm and applies Key Stretching techniques for security. A unique 20-byte Salt is added when generating passwords, and repeated hashing is performed for the number of times set in the caching_sha2_password_digest_rounds variable (default 5000 times). The stored hash value is identified by the $A$005$ format, containing the identifier, iteration count, salt, and final hash value.

The authentication process is divided into two types:

1. Full Authentication: Performed on initial connection or when no cache exists. The plaintext password is not transmitted; instead, it is securely delivered and verified via either SSL/TLS or RSA public key encryption.
2. Fast Authentication: Performs quick re-authentication based on a Nonce using information cached in server memory (Heap) after a previous successful connection. The cache is invalidated upon MySQL restart, FLUSH PRIVILEGES, or changes to account information.

Upon adoption, the connection method between client and server (SSL/TLS or RSA) must be determined, and infrastructure-level preparations are required, such as verifying version compatibility of existing connectors and changing connection methods for Replication and Group Replication accounts.