Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

<?php

use Chilkat2\BinData;
use Chilkat2\Crypt2;
use Chilkat2\JsonObject;

$crypt = new Crypt2();

// The password should come from a secure source rather than being hard-coded.
$password = 'correct horse battery staple';

// Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
//   secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
//                  application and NOT stored with the hash, so a stolen hash database cannot be
//                  attacked without it.
//   ad             optional associated data X: additional non-secret data bound into the derivation.
//   encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
//                  saltEncoding, secretEncoding, and adEncoding.
//   passwordCharset  the charset the password is converted to before use (default utf-8).
//   maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
//                  default 2097152 (2 GB).
$json = new JsonObject();

// The salt is provided here as hex, overriding the default base64 for just this member.
$json->UpdateString('salt', '0102030405060708090a0b0c0d0e0f10');
$json->UpdateString('saltEncoding', 'hex');

// The pepper is supplied as UTF-8 text (its own characters are the bytes).
$json->UpdateString('secret', 'application-wide-pepper');
$json->UpdateString('secretEncoding', 'utf-8');

// Associated data, supplied as UTF-8 text.
$json->UpdateString('ad', 'user-id-42');
$json->UpdateString('adEncoding', 'utf-8');

$json->UpdateString('passwordCharset', 'utf-8');
$json->UpdateInt('maxMemoryKb', 1048576);
$json->UpdateInt('keyLen', 32);

$bdKey = new BinData();
try {
    $crypt->Argon2DeriveKey($password, $json->Emit(), $bdKey);

    $keyHex = $bdKey->GetEncoded('hex');
} catch (\Chilkat2\Exception $e) {
    echo $e->getMessage(), "\n";
    exit;
}

echo 'Derived key: ', $keyHex, "\n";