PowerBuilder Requires Chilkat v11.6.0+

Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

Background. A pepper is a secret value held by the application and not stored with the hash, so a stolen hash database cannot be attacked without it. The encoding members control how the salt, secret, and ad text are interpreted as bytes (base64 by default; utf-8 uses the characters themselves). maxMemoryKb is a guard against an unreasonable memory cost.

Chilkat PowerBuilder Downloads

Download Chilkat for PowerBuilder

PowerBuilder

integer li_rc
integer li_Success
oleobject loo_Crypt
string ls_Password
oleobject loo_Json
oleobject loo_BdKey
string ls_KeyHex

li_Success = 0

loo_Crypt = create oleobject
li_rc = loo_Crypt.ConnectToNewObject("Chilkat.Crypt2")
if li_rc < 0 then
    destroy loo_Crypt
    MessageBox("Error","Connecting to COM object failed")
    return
end if

//  The password should come from a secure source rather than being hard-coded.
ls_Password = "correct horse battery staple"

//  Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
//    secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
//                   application and NOT stored with the hash, so a stolen hash database cannot be
//                   attacked without it.
//    ad             optional associated data X: additional non-secret data bound into the derivation.
//    encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
//                   saltEncoding, secretEncoding, and adEncoding.
//    passwordCharset  the charset the password is converted to before use (default utf-8).
//    maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
//                   default 2097152 (2 GB).
loo_Json = create oleobject
li_rc = loo_Json.ConnectToNewObject("Chilkat.JsonObject")

//  The salt is provided here as hex, overriding the default base64 for just this member.
loo_Json.UpdateString("salt","0102030405060708090a0b0c0d0e0f10")
loo_Json.UpdateString("saltEncoding","hex")

//  The pepper is supplied as UTF-8 text (its own characters are the bytes).
loo_Json.UpdateString("secret","application-wide-pepper")
loo_Json.UpdateString("secretEncoding","utf-8")

//  Associated data, supplied as UTF-8 text.
loo_Json.UpdateString("ad","user-id-42")
loo_Json.UpdateString("adEncoding","utf-8")

loo_Json.UpdateString("passwordCharset","utf-8")
loo_Json.UpdateInt("maxMemoryKb",1048576)
loo_Json.UpdateInt("keyLen",32)

loo_BdKey = create oleobject
li_rc = loo_BdKey.ConnectToNewObject("Chilkat.BinData")

li_Success = loo_Crypt.Argon2DeriveKey(ls_Password,loo_Json.Emit(),loo_BdKey)
if li_Success = 0 then
    Write-Debug loo_Crypt.LastErrorText
    destroy loo_Crypt
    destroy loo_Json
    destroy loo_BdKey
    return
end if

ls_KeyHex = loo_BdKey.GetEncoded("hex")
if loo_BdKey.LastMethodSuccess = 0 then
    Write-Debug loo_BdKey.LastErrorText
    destroy loo_Crypt
    destroy loo_Json
    destroy loo_BdKey
    return
end if

Write-Debug "Derived key: " + ls_KeyHex


destroy loo_Crypt
destroy loo_Json
destroy loo_BdKey