Verify an Argon2 Password with a Secret and Memory Guard

Demonstrates Crypt2.Argon2VerifyPassword when the hash was created with a secret (pepper) or ad, and the use of maxMemoryKb to guard against untrusted hash strings.

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.Crypt2,
  Chilkat.JsonObject;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  crypt: TCrypt2;
  password: string;
  phcHash: string;
  json: TJsonObject;
  verifyResult: Integer;

begin
  crypt := TCrypt2.Create;

  //  The password should come from a secure source rather than being hard-coded.
  password := 'correct horse battery staple';

  phcHash := '$argon2id$v=19$m=131072,t=4,p=2$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM';

  //  When the hash was created with a secret (pepper) or ad, the same values must be supplied to verify.
  //  Only the secret, ad, encoding, passwordCharset, and maxMemoryKb members of the options are used;
  //  everything else is ignored.
  json := TJsonObject.Create;
  json.UpdateString('secret','application-wide-pepper');
  json.UpdateString('secretEncoding','utf-8');

  //  maxMemoryKb guards against a hash from an untrusted source claiming an enormous memory cost.  The
  //  memory cost is taken from the hash string, so this limit is checked before any memory is allocated.
  //  It defaults to 2 GB.
  json.UpdateInt('maxMemoryKb',262144);

  //  Argon2VerifyPassword returns 1 if the password matched, 0 if it did not match, and -1 if the
  //  verification could not be performed.  Always test for a match with == 1.
  verifyResult := crypt.Argon2VerifyPassword(password,json.Emit(),phcHash);
  if (verifyResult = 1) then
    begin
      WriteLn('The password is verified.');
    end
  else
    begin
      if (verifyResult = 0) then
        begin
          WriteLn('The password does not match.');
        end
      else
        begin
          WriteLn('The verification could not be performed: ' + crypt.LastErrorText);
        end;
    end;


  crypt.Free;
  json.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.