Verify an Argon2 Password with a Secret and Memory Guard

Demonstrates Crypt2.Argon2VerifyPassword when the hash was created with a secret (pepper) or ad, and the use of maxMemoryKb to guard against untrusted hash strings.

var
crypt: HCkCrypt2;
password: PWideChar;
phcHash: PWideChar;
json: HCkJsonObject;
verifyResult: Integer;

begin
crypt := CkCrypt2_Create();

//  The password should come from a secure source rather than being hard-coded.
password := 'correct horse battery staple';

phcHash := '$argon2id$v=19$m=131072,t=4,p=2$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM';

//  When the hash was created with a secret (pepper) or ad, the same values must be supplied to verify.
//  Only the secret, ad, encoding, passwordCharset, and maxMemoryKb members of the options are used;
//  everything else is ignored.
json := CkJsonObject_Create();
CkJsonObject_UpdateString(json,'secret','application-wide-pepper');
CkJsonObject_UpdateString(json,'secretEncoding','utf-8');

//  maxMemoryKb guards against a hash from an untrusted source claiming an enormous memory cost.  The
//  memory cost is taken from the hash string, so this limit is checked before any memory is allocated.
//  It defaults to 2 GB.
CkJsonObject_UpdateInt(json,'maxMemoryKb',262144);

//  Argon2VerifyPassword returns 1 if the password matched, 0 if it did not match, and -1 if the
//  verification could not be performed.  Always test for a match with == 1.
verifyResult := CkCrypt2_Argon2VerifyPassword(crypt,password,CkJsonObject__emit(json),phcHash);
if (verifyResult = 1) then
  begin
    Memo1.Lines.Add('The password is verified.');
  end
else
  begin
    if (verifyResult = 0) then
      begin
        Memo1.Lines.Add('The password does not match.');
      end
    else
      begin
        Memo1.Lines.Add('The verification could not be performed: ' + CkCrypt2__lastErrorText(crypt));
      end;
  end;

CkCrypt2_Dispose(crypt);
CkJsonObject_Dispose(json);