Firebird 3 WireCrypt Required with Srp Only Authentication – Remote Legacy Client Connection Fails

Goal: Configure a Firebird 3 server so that remote clients using the Srp authentication plugin can connect securely while legacy clients that rely on Legacy_Auth are also able to authenticate, without disabling WireCrypt encryption.

Constraint: The server presently has AuthServer set to Srp only and WireCrypt set to Required; legacy clients receive a connection‑rejected error, whereas adding Legacy_Auth to AuthServer restores access but weakens password protection because Legacy_Auth uses an 8‑character‑effective hash.

Uncertainty: It is unclear whether specifying both Srp and Legacy_Auth in AuthServer allows the server to prefer Srp for new connections while still accepting Legacy_Auth as a fallback, and how the WireCrypt setting interacts with this plugin negotiation.

Which AuthServer value enables Srp‑first negotiation with Legacy_Auth fallback? Does WireCrypt = Required enforce encryption for both Srp and Legacy_Auth paths? Can legacy authentication be isolated to a separate port or instance to avoid weakening the overall security posture?