Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

import sys
import chilkat2

success = False

crypt = chilkat2.Crypt2()

# The password should come from a secure source rather than being hard-coded.
password = "correct horse battery staple"

# Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
#   secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
#                  application and NOT stored with the hash, so a stolen hash database cannot be
#                  attacked without it.
#   ad             optional associated data X: additional non-secret data bound into the derivation.
#   encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
#                  saltEncoding, secretEncoding, and adEncoding.
#   passwordCharset  the charset the password is converted to before use (default utf-8).
#   maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
#                  default 2097152 (2 GB).
json = chilkat2.JsonObject()

# The salt is provided here as hex, overriding the default base64 for just this member.
json.UpdateString("salt","0102030405060708090a0b0c0d0e0f10")
json.UpdateString("saltEncoding","hex")

# The pepper is supplied as UTF-8 text (its own characters are the bytes).
json.UpdateString("secret","application-wide-pepper")
json.UpdateString("secretEncoding","utf-8")

# Associated data, supplied as UTF-8 text.
json.UpdateString("ad","user-id-42")
json.UpdateString("adEncoding","utf-8")

json.UpdateString("passwordCharset","utf-8")
json.UpdateInt("maxMemoryKb",1048576)
json.UpdateInt("keyLen",32)

bdKey = chilkat2.BinData()
success = crypt.Argon2DeriveKey(password,json.Emit(),bdKey)
if (success == False):
    print(crypt.LastErrorText)
    sys.exit()

keyHex = bdKey.GetEncoded("hex")
if (bdKey.LastMethodSuccess == False):
    print(bdKey.LastErrorText)
    sys.exit()

print("Derived key: " + keyHex)