Verify an Argon2 Password with a Secret and Memory Guard

Demonstrates Crypt2.Argon2VerifyPassword when the hash was created with a secret (pepper) or ad, and the use of maxMemoryKb to guard against untrusted hash strings.

integer li_rc
oleobject loo_Crypt
string ls_Password
string ls_PhcHash
oleobject loo_Json
integer li_VerifyResult

loo_Crypt = create oleobject
li_rc = loo_Crypt.ConnectToNewObject("Chilkat.Crypt2")
if li_rc < 0 then
    destroy loo_Crypt
    MessageBox("Error","Connecting to COM object failed")
    return
end if

//  The password should come from a secure source rather than being hard-coded.
ls_Password = "correct horse battery staple"

ls_PhcHash = "$argon2id$v=19$m=131072,t=4,p=2$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM"

//  When the hash was created with a secret (pepper) or ad, the same values must be supplied to verify.
//  Only the secret, ad, encoding, passwordCharset, and maxMemoryKb members of the options are used;
//  everything else is ignored.
loo_Json = create oleobject
li_rc = loo_Json.ConnectToNewObject("Chilkat.JsonObject")

loo_Json.UpdateString("secret","application-wide-pepper")
loo_Json.UpdateString("secretEncoding","utf-8")

//  maxMemoryKb guards against a hash from an untrusted source claiming an enormous memory cost.  The
//  memory cost is taken from the hash string, so this limit is checked before any memory is allocated.
//  It defaults to 2 GB.
loo_Json.UpdateInt("maxMemoryKb",262144)

//  Argon2VerifyPassword returns 1 if the password matched, 0 if it did not match, and -1 if the
//  verification could not be performed.  Always test for a match with == 1.
li_VerifyResult = loo_Crypt.Argon2VerifyPassword(ls_Password,loo_Json.Emit(),ls_PhcHash)
if li_VerifyResult = 1 then
    Write-Debug "The password is verified."
else
    if li_VerifyResult = 0 then
        Write-Debug "The password does not match."
    else
        Write-Debug "The verification could not be performed: " + loo_Crypt.LastErrorText
    end if

end if



destroy loo_Crypt
destroy loo_Json