Perl Requires Chilkat v11.6.0+

Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

Background. A pepper is a secret value held by the application and not stored with the hash, so a stolen hash database cannot be attacked without it. The encoding members control how the salt, secret, and ad text are interpreted as bytes (base64 by default; utf-8 uses the characters themselves). maxMemoryKb is a guard against an unreasonable memory cost.

Chilkat Perl Downloads

Download Chilkat for Perl

Perl

use chilkat();

$success = 0;

$crypt = chilkat::CkCrypt2->new();

#  The password should come from a secure source rather than being hard-coded.
$password = "correct horse battery staple";

#  Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
#    secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
#                   application and NOT stored with the hash, so a stolen hash database cannot be
#                   attacked without it.
#    ad             optional associated data X: additional non-secret data bound into the derivation.
#    encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
#                   saltEncoding, secretEncoding, and adEncoding.
#    passwordCharset  the charset the password is converted to before use (default utf-8).
#    maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
#                   default 2097152 (2 GB).
$json = chilkat::CkJsonObject->new();

#  The salt is provided here as hex, overriding the default base64 for just this member.
$json->UpdateString("salt","0102030405060708090a0b0c0d0e0f10");
$json->UpdateString("saltEncoding","hex");

#  The pepper is supplied as UTF-8 text (its own characters are the bytes).
$json->UpdateString("secret","application-wide-pepper");
$json->UpdateString("secretEncoding","utf-8");

#  Associated data, supplied as UTF-8 text.
$json->UpdateString("ad","user-id-42");
$json->UpdateString("adEncoding","utf-8");

$json->UpdateString("passwordCharset","utf-8");
$json->UpdateInt("maxMemoryKb",1048576);
$json->UpdateInt("keyLen",32);

$bdKey = chilkat::CkBinData->new();
$success = $crypt->Argon2DeriveKey($password,$json->emit(),$bdKey);
if ($success == 0) {
    print $crypt->lastErrorText() . "\r\n";
    exit;
}

$keyHex = $bdKey->getEncoded("hex");
if ($bdKey->get_LastMethodSuccess() == 0) {
    print $bdKey->lastErrorText() . "\r\n";
    exit;
}

print "Derived key: " . $keyHex . "\r\n";