Publication date: March 29, 2023
Description
Starting in CockroachDB v22.2.0 and above, CockroachDB switched to using the SCRAM protocol for password authentication by default. The SCRAM protocol dictates that the password hash is computed on the client side and sent to the server instead of sending a cleartext password. After testing we determined the optimal default hash cost (iteration count) to be 119680. However, this default hashing cost was high for certain clients running on a limited amount of CPU, which resulted in higher than normal connection latency after upgrading to CockroachDB v22.2.0 and above.
Statement
This is resolved in CockroachDB by PR 98254, which sets the default hash cost value to 10610 using the cluster setting server.user_login.password_hashes.default_cost.scram_sha_256. This fix has been released in 22.2.7.
The public issue is tracked by 97932.
Mitigation
Users of CockroachDB v22.2.0 to v22.2.6, should set the value of the cluster setting server.user_login.password_hashes.default_cost.scram_sha_256 to 10610. You will also need to run ALTER USER ... WITH PASSWORD for every user in order to recompute the hash using the lower cost of 10610.
Alternatively, if your application is unaffected or you are not experiencing an increase in connection latency, the 22.2.7 release of CockroachDB will include the lower default hashing cost. This will be applied automatically during the upgrade without any user intervention.
Impact
Customers upgrading their CockroachDB versions to 22.2.0 and above may see an increase in connection latency after upgrade. Versions affected include all versions of CockroachDB v22.2.0 to v22.2.6.
Questions about any technical alert can be directed to our support team.
Was this helpful?
