Definition

The server side plugin name is authentication_fido
The client side plugin name is authentication_fido_client
Account - user account (user-host combination)
authentication_string - Transformation of Credential ID stored in mysql.user table
relying party ID - Unique name assigned to server by authentication_fido plugin
FIDO authenticator - A hardware token device
Salt - 32 byte long random data
Registration mode - Refers to state of connection where only ALTER USER is allowed to do registration steps.

How authentication_fido works?

Plugin authentication_fido works in two phases.

Registration of hardware token device
Authentication process

Registration process: This is a 2 step process for a given user account.

Initiate registration step.
Finish registration step.

Initiate registration: –fido-register-factor mysql client option initiates registration step.

Client executes ALTER USER user() nth FACTOR INITIATE REGISTRATION;
Server sends a challenge comprising of 32 bytes random salt, user id, relying party ID Format of challenge is: |length encoded 32 bytes random salt|length encoded user id (user name + host name)|length encoded relying party ID|
Client receives challenge and passes to authentication_fido_client plugin with option "registration_challenge" using mysql_plugin_options()
FIDO authenticator prompts physical human user to perform gesture action. This message can be accessed via callback. Register a callback with option "fido_messages_callback" using mysql_plugin_options()
Once physical human user gesture action (touching the token) is performed, FIDO authenticator generates a public/private key pair, a credential ID( X.509 certificate, signature) and authenticator data.
Client extracts credential ID(aka challenge response) from authentication_fido_client plugin with option "registration_response" using mysql_plugin_get_option() Format of challenge response is: |length encoded authenticator data|length encoded credential ID|

Finish registration:

Client executes ALTER USER user() nth FACTOR FINISH REGISTRATION SET CHALLENGE_RESPONSE AS '?'; parameter is binded to challenge response received during initiate registration step.
authentication_fido plugin verifies the challenge response and responds with an OK_Packet or rejects with ERR_Packet

Authentication process: Once initial authentication methods defined for user account are successful, server initiates fido authentication process. This includes following steps:

Server sends a 32 byte random salt, relying party ID, credential ID to client.
Client receives it and sends to FIDO authenticator.
FIDO authenticator prompts physical human user to perform gesture action.
FIDO authenticator extracts the private key based on relying party ID and signs the challenge.
Client sends signed challenge to server.
Server side fido authentication plugin verifies the signature with the public key and responds with an OK_Packet or with ERR_Packet