Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

import com.chilkatsoft.*;

public class ChilkatExample {

  static {
    try {
        System.loadLibrary("chilkat");
    } catch (UnsatisfiedLinkError e) {
      System.err.println("Native code library failed to load.\n" + e);
      System.exit(1);
    }
  }

  public static void main(String argv[])
  {
    boolean success = false;

    CkCrypt2 crypt = new CkCrypt2();

    //  The password should come from a secure source rather than being hard-coded.
    String password = "correct horse battery staple";

    //  Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
    //    secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
    //                   application and NOT stored with the hash, so a stolen hash database cannot be
    //                   attacked without it.
    //    ad             optional associated data X: additional non-secret data bound into the derivation.
    //    encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
    //                   saltEncoding, secretEncoding, and adEncoding.
    //    passwordCharset  the charset the password is converted to before use (default utf-8).
    //    maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
    //                   default 2097152 (2 GB).
    CkJsonObject json = new CkJsonObject();

    //  The salt is provided here as hex, overriding the default base64 for just this member.
    json.UpdateString("salt","0102030405060708090a0b0c0d0e0f10");
    json.UpdateString("saltEncoding","hex");

    //  The pepper is supplied as UTF-8 text (its own characters are the bytes).
    json.UpdateString("secret","application-wide-pepper");
    json.UpdateString("secretEncoding","utf-8");

    //  Associated data, supplied as UTF-8 text.
    json.UpdateString("ad","user-id-42");
    json.UpdateString("adEncoding","utf-8");

    json.UpdateString("passwordCharset","utf-8");
    json.UpdateInt("maxMemoryKb",1048576);
    json.UpdateInt("keyLen",32);

    CkBinData bdKey = new CkBinData();
    success = crypt.Argon2DeriveKey(password,json.emit(),bdKey);
    if (success == false) {
        System.out.println(crypt.lastErrorText());
        return;
        }

    String keyHex = bdKey.getEncoded("hex");
    if (bdKey.get_LastMethodSuccess() == false) {
        System.out.println(bdKey.lastErrorText());
        return;
        }

    System.out.println("Derived key: " + keyHex);
  }
}