Verify an Argon2 Password with a Secret and Memory Guard

Demonstrates Crypt2.Argon2VerifyPassword when the hash was created with a secret (pepper) or ad, and the use of maxMemoryKb to guard against untrusted hash strings.

Add-Type -Path "C:\chilkat\ChilkatDotNet47-x64\ChilkatDotNet47.dll"

$crypt = New-Object Chilkat.Crypt2

#  The password should come from a secure source rather than being hard-coded.
$password = "correct horse battery staple"

$phcHash = "$argon2id$v=19$m=131072,t=4,p=2$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM"

#  When the hash was created with a secret (pepper) or ad, the same values must be supplied to verify.
#  Only the secret, ad, encoding, passwordCharset, and maxMemoryKb members of the options are used;
#  everything else is ignored.
$json = New-Object Chilkat.JsonObject
$json.UpdateString("secret","application-wide-pepper")
$json.UpdateString("secretEncoding","utf-8")

#  maxMemoryKb guards against a hash from an untrusted source claiming an enormous memory cost.  The
#  memory cost is taken from the hash string, so this limit is checked before any memory is allocated.
#  It defaults to 2 GB.
$json.UpdateInt("maxMemoryKb",262144)

#  Argon2VerifyPassword returns 1 if the password matched, 0 if it did not match, and -1 if the
#  verification could not be performed.  Always test for a match with == 1.
$verifyResult = $crypt.Argon2VerifyPassword($password,$json.Emit(),$phcHash)
if ($verifyResult -eq 1) {
    $("The password is verified.")
}
else {
    if ($verifyResult -eq 0) {
        $("The password does not match.")
    }
    else {
        $("The verification could not be performed: " + $crypt.LastErrorText)
    }

}