Verify an Argon2 Password with a Secret and Memory Guard

Demonstrates Crypt2.Argon2VerifyPassword when the hash was created with a secret (pepper) or ad, and the use of maxMemoryKb to guard against untrusted hash strings.

#import <CkoCrypt2.h>
#import <NSString.h>
#import <CkoJsonObject.h>

CkoCrypt2 *crypt = [[CkoCrypt2 alloc] init];

//  The password should come from a secure source rather than being hard-coded.
NSString *password = @"correct horse battery staple";

NSString *phcHash = @"$argon2id$v=19$m=131072,t=4,p=2$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM";

//  When the hash was created with a secret (pepper) or ad, the same values must be supplied to verify.
//  Only the secret, ad, encoding, passwordCharset, and maxMemoryKb members of the options are used;
//  everything else is ignored.
CkoJsonObject *json = [[CkoJsonObject alloc] init];
[json UpdateString: @"secret" value: @"application-wide-pepper"];
[json UpdateString: @"secretEncoding" value: @"utf-8"];

//  maxMemoryKb guards against a hash from an untrusted source claiming an enormous memory cost.  The
//  memory cost is taken from the hash string, so this limit is checked before any memory is allocated.
//  It defaults to 2 GB.
[json UpdateInt: @"maxMemoryKb" value: [NSNumber numberWithInt: 262144]];

//  Argon2VerifyPassword returns 1 if the password matched, 0 if it did not match, and -1 if the
//  verification could not be performed.  Always test for a match with == 1.
int verifyResult = [[crypt Argon2VerifyPassword: password json: [json Emit] phcHash: phcHash] intValue];
if (verifyResult == 1) {
    NSLog(@"%@",@"The password is verified.");
}
else {
    if (verifyResult == 0) {
        NSLog(@"%@",@"The password does not match.");
    }
    else {
        NSLog(@"%@%@",@"The verification could not be performed: ",crypt.LastErrorText);
    }

}