Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.BinData,
  Chilkat.JsonObject,
  Chilkat.Crypt2;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  crypt: TCrypt2;
  password: string;
  json: TJsonObject;
  bdKey: TBinData;
  keyHex: string;

begin
  success := False;

  crypt := TCrypt2.Create;

  //  The password should come from a secure source rather than being hard-coded.
  password := 'correct horse battery staple';

  //  Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
  //    secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
  //                   application and NOT stored with the hash, so a stolen hash database cannot be
  //                   attacked without it.
  //    ad             optional associated data X: additional non-secret data bound into the derivation.
  //    encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
  //                   saltEncoding, secretEncoding, and adEncoding.
  //    passwordCharset  the charset the password is converted to before use (default utf-8).
  //    maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
  //                   default 2097152 (2 GB).
  json := TJsonObject.Create;

  //  The salt is provided here as hex, overriding the default base64 for just this member.
  json.UpdateString('salt','0102030405060708090a0b0c0d0e0f10');
  json.UpdateString('saltEncoding','hex');

  //  The pepper is supplied as UTF-8 text (its own characters are the bytes).
  json.UpdateString('secret','application-wide-pepper');
  json.UpdateString('secretEncoding','utf-8');

  //  Associated data, supplied as UTF-8 text.
  json.UpdateString('ad','user-id-42');
  json.UpdateString('adEncoding','utf-8');

  json.UpdateString('passwordCharset','utf-8');
  json.UpdateInt('maxMemoryKb',1048576);
  json.UpdateInt('keyLen',32);

  bdKey := TBinData.Create;
  success := crypt.Argon2DeriveKey(password,json.Emit(),bdKey);
  if (success = False) then
    begin
      WriteLn(crypt.LastErrorText);
      Exit;
    end;

  keyHex := bdKey.GetEncoded('hex');
  if (bdKey.LastMethodSuccess = False) then
    begin
      WriteLn(bdKey.LastErrorText);
      Exit;
    end;
  WriteLn('Derived key: ' + keyHex);


  crypt.Free;
  json.Free;
  bdKey.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.