Verify a Password against an Argon2 Hash

Demonstrates Crypt2.Argon2VerifyPassword, which verifies a password against a PHC-format Argon2 hash string. The cost parameters are read from the hash string, so none need to be supplied.

var
crypt: HCkCrypt2;
password: PWideChar;
phcHash: PWideChar;
verifyResult: Integer;

begin
crypt := CkCrypt2_Create();

//  The password should come from a secure source rather than being hard-coded.
password := 'correct horse battery staple';

//  A PHC-format Argon2 hash string previously produced by Argon2HashPassword.  All cost options
//  (variant, version, memory cost, iterations, parallelism, salt, hash length) are read from this
//  string, so none need to be supplied.
phcHash := '$argon2id$v=19$m=65536,t=3,p=1$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM';

//  Verify the password.  Pass an empty options string when no secret (pepper) or ad was used.
//  The method returns one of three values:  1 = the password matched, 0 = it did not match, and
//  -1 = the verification could not be performed (the hash string was invalid or unusable).
//  Always test for a match with == 1.
verifyResult := CkCrypt2_Argon2VerifyPassword(crypt,password,'',phcHash);
if (verifyResult = 1) then
  begin
    Memo1.Lines.Add('The password is verified.');
  end
else
  begin
    if (verifyResult = 0) then
      begin
        Memo1.Lines.Add('The password does not match.');
      end
    else
      begin
        Memo1.Lines.Add('The verification could not be performed: ' + CkCrypt2__lastErrorText(crypt));
      end;
  end;

CkCrypt2_Dispose(crypt);