PowerBuilder Requires Chilkat v11.6.0+

Derive a Key from a Password with Argon2

Demonstrates Crypt2.Argon2DeriveKey, which derives a key from a password using Argon2. The options JSON requires a salt (chosen and stored by the application) and accepts the cost parameters variant, version, iterations, memoryCostKb, parallelism, and keyLen.

Background. Argon2 (RFC 9106) is a memory-hard function that is deliberately expensive in CPU time and memory, which is what makes brute-forcing the password space costly. The argon2id variant is recommended unless there is a specific reason to choose argon2i or argon2d. memoryCostKb does the most to make an attack expensive. The salt, cost parameters, and options must be stored so the same key can be re-derived.

Chilkat PowerBuilder Downloads

Download Chilkat for PowerBuilder

PowerBuilder

integer li_rc
integer li_Success
oleobject loo_Crypt
string ls_Password
string ls_SaltB64
oleobject loo_Json
oleobject loo_BdKey
string ls_KeyHex

li_Success = 0

loo_Crypt = create oleobject
li_rc = loo_Crypt.ConnectToNewObject("Chilkat.Crypt2")
if li_rc < 0 then
    destroy loo_Crypt
    MessageBox("Error","Connecting to COM object failed")
    return
end if

//  The password should come from a secure source rather than being hard-coded.
ls_Password = "correct horse battery staple"

//  A key-derivation salt is chosen and stored by the application.  Generate 16 random bytes and use
//  them (base64) as the salt.  The salt encoding defaults to base64.
loo_Crypt.EncodingMode = "base64"
ls_SaltB64 = loo_Crypt.GenRandomBytesENC(16)

//  Build the Argon2 options JSON.  Only "salt" is required; every other member is optional and shown
//  here with a typical explicit value:
//    variant       argon2id (default), argon2i, or argon2d
//    version       19 (default, 0x13) or 16 (0x10)
//    iterations    passes over memory (t), >= 1, default 3
//    memoryCostKb  memory in KB (m), >= 8*parallelism, default 65536 (64 MB)
//    parallelism   lanes (p), default 1
//    keyLen        derived key length in bytes, 4..1048576, default 32
loo_Json = create oleobject
li_rc = loo_Json.ConnectToNewObject("Chilkat.JsonObject")

loo_Json.UpdateString("variant","argon2id")
loo_Json.UpdateInt("version",19)
loo_Json.UpdateInt("iterations",3)
loo_Json.UpdateInt("memoryCostKb",65536)
loo_Json.UpdateInt("parallelism",1)
loo_Json.UpdateInt("keyLen",32)
loo_Json.UpdateString("salt",ls_SaltB64)

//  Derive the key.  The derived key is returned in the BinData (cleared first).
loo_BdKey = create oleobject
li_rc = loo_BdKey.ConnectToNewObject("Chilkat.BinData")

li_Success = loo_Crypt.Argon2DeriveKey(ls_Password,loo_Json.Emit(),loo_BdKey)
if li_Success = 0 then
    Write-Debug loo_Crypt.LastErrorText
    destroy loo_Crypt
    destroy loo_Json
    destroy loo_BdKey
    return
end if

//  The application stores the salt and cost parameters so the same key can be re-derived later.
ls_KeyHex = loo_BdKey.GetEncoded("hex")
if loo_BdKey.LastMethodSuccess = 0 then
    Write-Debug loo_BdKey.LastErrorText
    destroy loo_Crypt
    destroy loo_Json
    destroy loo_BdKey
    return
end if

Write-Debug "Derived " + string(loo_BdKey.NumBytes) + "-byte key: " + ls_KeyHex


destroy loo_Crypt
destroy loo_Json
destroy loo_BdKey