Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

import com.chilkatsoft.chilkat2.BinData;
import com.chilkatsoft.chilkat2.ChilkatException;
import com.chilkatsoft.chilkat2.Crypt2;
import com.chilkatsoft.chilkat2.JsonObject;

public class ChilkatExample {

    public static void main(String[] args) {
        Crypt2 crypt = new Crypt2();

        // The password should come from a secure source rather than being hard-coded.
        String password = "correct horse battery staple";

        // Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
        //   secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
        //                  application and NOT stored with the hash, so a stolen hash database cannot be
        //                  attacked without it.
        //   ad             optional associated data X: additional non-secret data bound into the derivation.
        //   encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
        //                  saltEncoding, secretEncoding, and adEncoding.
        //   passwordCharset  the charset the password is converted to before use (default utf-8).
        //   maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
        //                  default 2097152 (2 GB).
        JsonObject json = new JsonObject();

        // The salt is provided here as hex, overriding the default base64 for just this member.
        json.updateString("salt", "0102030405060708090a0b0c0d0e0f10");
        json.updateString("saltEncoding", "hex");

        // The pepper is supplied as UTF-8 text (its own characters are the bytes).
        json.updateString("secret", "application-wide-pepper");
        json.updateString("secretEncoding", "utf-8");

        // Associated data, supplied as UTF-8 text.
        json.updateString("ad", "user-id-42");
        json.updateString("adEncoding", "utf-8");

        json.updateString("passwordCharset", "utf-8");
        json.updateInt("maxMemoryKb", 1048576);
        json.updateInt("keyLen", 32);

        BinData bdKey = new BinData();
        String keyHex;
        try {
            crypt.argon2DeriveKey(password, json.emit(), bdKey);

            keyHex = bdKey.getEncoded("hex");
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        System.out.println("Derived key: " + keyHex);
    }
}