diff --git a/DBSyn/MySQLProtocol.swift b/DBSyn/MySQLProtocol.swift
index 2bf5e5d..51b0a8f 100644
--- a/DBSyn/MySQLProtocol.swift
+++ b/DBSyn/MySQLProtocol.swift
@@ -262,6 +262,7 @@ private final class MySQLSocketTransport {
     }
 
     func startTLS(host: String, verify: Bool) throws {
+        NSLog("DBSyn TLS: host=%@ verify=%@", host, verify ? "ON" : "OFF")
         guard let context = SSLCreateContext(nil, .clientSide, .streamType) else {
             throw MySQLWireError(message: "Unable to create MySQL TLS context")
         }
@@ -407,6 +408,13 @@ final class MySQLWireConnection {
         _ = try c.take(10)
         let salt2 = try c.take(max(13, authLen - 8))
         let salt = salt1 + salt2.prefix(max(0, authLen - 9))
+
+        // MySQL authentication uses the 20-byte server challenge.
+        guard salt.count == 20 else {
+            throw MySQLWireError(
+                message: "Invalid MySQL authentication challenge length: \(salt.count)"
+            )
+        }
         let plugin = (try? c.nulString()) ?? "mysql_native_password"
         if requireTLS {
             let clientSSL = 0x00000800