Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

#import <CkoCrypt2.h>
#import <NSString.h>
#import <CkoJsonObject.h>
#import <CkoBinData.h>

BOOL success = NO;

CkoCrypt2 *crypt = [[CkoCrypt2 alloc] init];

//  The password should come from a secure source rather than being hard-coded.
NSString *password = @"correct horse battery staple";

//  Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
//    secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
//                   application and NOT stored with the hash, so a stolen hash database cannot be
//                   attacked without it.
//    ad             optional associated data X: additional non-secret data bound into the derivation.
//    encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
//                   saltEncoding, secretEncoding, and adEncoding.
//    passwordCharset  the charset the password is converted to before use (default utf-8).
//    maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
//                   default 2097152 (2 GB).
CkoJsonObject *json = [[CkoJsonObject alloc] init];

//  The salt is provided here as hex, overriding the default base64 for just this member.
[json UpdateString: @"salt" value: @"0102030405060708090a0b0c0d0e0f10"];
[json UpdateString: @"saltEncoding" value: @"hex"];

//  The pepper is supplied as UTF-8 text (its own characters are the bytes).
[json UpdateString: @"secret" value: @"application-wide-pepper"];
[json UpdateString: @"secretEncoding" value: @"utf-8"];

//  Associated data, supplied as UTF-8 text.
[json UpdateString: @"ad" value: @"user-id-42"];
[json UpdateString: @"adEncoding" value: @"utf-8"];

[json UpdateString: @"passwordCharset" value: @"utf-8"];
[json UpdateInt: @"maxMemoryKb" value: [NSNumber numberWithInt: 1048576]];
[json UpdateInt: @"keyLen" value: [NSNumber numberWithInt: 32]];

CkoBinData *bdKey = [[CkoBinData alloc] init];
success = [crypt Argon2DeriveKey: password json: [json Emit] bdKey: bdKey];
if (success == NO) {
    NSLog(@"%@",crypt.LastErrorText);
    return;
}

NSString *keyHex = [bdKey GetEncoded: @"hex"];
if (bdKey.LastMethodSuccess == NO) {
    NSLog(@"%@",bdKey.LastErrorText);
    return;
}

NSLog(@"%@%@",@"Derived key: ",keyHex);