Change parameter name for clarity and update documentation.

Signed-off-by: Bradley Grainger <[email protected]>

Author: bgrainger

src/MySqlConnector/Core/ServerSession.cs

@@ -624,7 +624,7 @@ private bool ValidateFingerprint(byte[]? validationHash, ReadOnlySpan<byte> chal
 		switch (m_pluginName)
 		{
 			case "mysql_native_password":
-				passwordHashResult = AuthenticationUtility.HashPassword([], password, false);
+				passwordHashResult = AuthenticationUtility.HashPassword([], password, onlyHashPassword: true);
 				break;
 
 			case "client_ed25519":

src/MySqlConnector/Protocol/Serialization/AuthenticationUtility.cs

@@ -25,20 +25,22 @@ public static byte[] GetNullTerminatedPasswordBytes(string password)
 	}
 
 	public static byte[] CreateAuthenticationResponse(ReadOnlySpan<byte> challenge, string password) =>
-		string.IsNullOrEmpty(password) ? [] : HashPassword(challenge, password, true);
+		string.IsNullOrEmpty(password) ? [] : HashPassword(challenge, password, false);
 
 	/// <summary>
 	/// Hashes a password with the "Secure Password Authentication" method.
 	/// </summary>
 	/// <param name="challenge">The 20-byte random challenge (from the "auth-plugin-data" in the initial handshake).</param>
 	/// <param name="password">The password to hash.</param>
-	/// <param name="withXor">must xor results.</param>
+	/// <param name="onlyHashPassword">If true, <paramref name="challenge"/> is ignored and only the twice-hashed password
+	/// is returned, instead of performing the full "secure password authentication" algorithm that XORs the hashed password against
+	/// a hash derived from the challenge.</param>
 	/// <returns>A 20-byte password hash.</returns>
 	/// <remarks>See <a href="https://dev.mysql.com/doc/internals/en/secure-password-authentication.html">Secure Password Authentication</a>.</remarks>
 #if NET5_0_OR_GREATER
 	[SkipLocalsInit]
 #endif
-	public static byte[] HashPassword(ReadOnlySpan<byte> challenge, string password, bool withXor)
+	public static byte[] HashPassword(ReadOnlySpan<byte> challenge, string password, bool onlyHashPassword)
 	{
 #if !NET5_0_OR_GREATER
 		using var sha1 = SHA1.Create();
@@ -56,7 +58,7 @@ public static byte[] HashPassword(ReadOnlySpan<byte> challenge, string password,
 		sha1.TryComputeHash(passwordBytes, hashedPassword, out _);
 		sha1.TryComputeHash(hashedPassword, combined[20..], out _);
 #endif
-		if (!withXor)
+		if (onlyHashPassword)
 			return combined[20..].ToArray();
 
 		challenge[..20].CopyTo(combined);