AutoIt Requires Chilkat v11.6.0+

Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

Background. A pepper is a secret value held by the application and not stored with the hash, so a stolen hash database cannot be attacked without it. The encoding members control how the salt, secret, and ad text are interpreted as bytes (base64 by default; utf-8 uses the characters themselves). maxMemoryKb is a guard against an unreasonable memory cost.

Chilkat AutoIt Downloads

Download Chilkat for AutoIt

AutoIt

Local $bSuccess = False

$oCrypt = ObjCreate("Chilkat.Crypt2")

;  The password should come from a secure source rather than being hard-coded.
Local $sPassword = "correct horse battery staple"

;  Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
;    secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
;                   application and NOT stored with the hash, so a stolen hash database cannot be
;                   attacked without it.
;    ad             optional associated data X: additional non-secret data bound into the derivation.
;    encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
;                   saltEncoding, secretEncoding, and adEncoding.
;    passwordCharset  the charset the password is converted to before use (default utf-8).
;    maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
;                   default 2097152 (2 GB).
$oJson = ObjCreate("Chilkat.JsonObject")

;  The salt is provided here as hex, overriding the default base64 for just this member.
$oJson.UpdateString("salt","0102030405060708090a0b0c0d0e0f10")
$oJson.UpdateString("saltEncoding","hex")

;  The pepper is supplied as UTF-8 text (its own characters are the bytes).
$oJson.UpdateString("secret","application-wide-pepper")
$oJson.UpdateString("secretEncoding","utf-8")

;  Associated data, supplied as UTF-8 text.
$oJson.UpdateString("ad","user-id-42")
$oJson.UpdateString("adEncoding","utf-8")

$oJson.UpdateString("passwordCharset","utf-8")
$oJson.UpdateInt("maxMemoryKb",1048576)
$oJson.UpdateInt("keyLen",32)

$oBdKey = ObjCreate("Chilkat.BinData")
$bSuccess = $oCrypt.Argon2DeriveKey($sPassword,$oJson.Emit(),$oBdKey)
If ($bSuccess = False) Then
    ConsoleWrite($oCrypt.LastErrorText & @CRLF)
    Exit
EndIf

Local $sKeyHex = $oBdKey.GetEncoded("hex")
If ($oBdKey.LastMethodSuccess = False) Then
    ConsoleWrite($oBdKey.LastErrorText & @CRLF)
    Exit
EndIf

ConsoleWrite("Derived key: " & $sKeyHex & @CRLF)