Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

import 'package:chilkat/chilkat.dart';

void main() {
  final crypt = CkCrypt2();

  // The password should come from a secure source rather than being hard-coded.
  final password = 'correct horse battery staple';

  // Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
  //   secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
  //                  application and NOT stored with the hash, so a stolen hash database cannot be
  //                  attacked without it.
  //   ad             optional associated data X: additional non-secret data bound into the derivation.
  //   encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
  //                  saltEncoding, secretEncoding, and adEncoding.
  //   passwordCharset  the charset the password is converted to before use (default utf-8).
  //   maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
  //                  default 2097152 (2 GB).
  final json = CkJsonObject();

  // The salt is provided here as hex, overriding the default base64 for just this member.
  json.updateString('salt', '0102030405060708090a0b0c0d0e0f10');
  json.updateString('saltEncoding', 'hex');

  // The pepper is supplied as UTF-8 text (its own characters are the bytes).
  json.updateString('secret', 'application-wide-pepper');
  json.updateString('secretEncoding', 'utf-8');

  // Associated data, supplied as UTF-8 text.
  json.updateString('ad', 'user-id-42');
  json.updateString('adEncoding', 'utf-8');

  json.updateString('passwordCharset', 'utf-8');
  json.updateInt('maxMemoryKb', 1048576);
  json.updateInt('keyLen', 32);

  final bdKey = CkBinData();
  try {
    crypt.argon2DeriveKey(password, json.emit(), bdKey);
  } on ChilkatException catch (e) {
    print(e.lastErrorText);
    return;
  }

  final String keyHex;
  try {
    keyHex = bdKey.getEncoded('hex');
  } on ChilkatException catch (e) {
    print(e.lastErrorText);
    return;
  }

  print('Derived key: $keyHex');
}