PureBasic Requires Chilkat v11.6.0+

Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

Background. A pepper is a secret value held by the application and not stored with the hash, so a stolen hash database cannot be attacked without it. The encoding members control how the salt, secret, and ad text are interpreted as bytes (base64 by default; utf-8 uses the characters themselves). maxMemoryKb is a guard against an unreasonable memory cost.

Chilkat PureBasic Downloads

Download Chilkat for PureBasic

PureBasic

IncludeFile "CkBinData.pb"
IncludeFile "CkJsonObject.pb"
IncludeFile "CkCrypt2.pb"

Procedure ChilkatExample()

    success.i = 0

    crypt.i = CkCrypt2::ckCreate()
    If crypt.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ;  The password should come from a secure source rather than being hard-coded.
    password.s = "correct horse battery staple"

    ;  Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
    ;    secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
    ;                   application and NOT stored with the hash, so a stolen hash database cannot be
    ;                   attacked without it.
    ;    ad             optional associated data X: additional non-secret data bound into the derivation.
    ;    encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
    ;                   saltEncoding, secretEncoding, and adEncoding.
    ;    passwordCharset  the charset the password is converted to before use (default utf-8).
    ;    maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
    ;                   default 2097152 (2 GB).
    json.i = CkJsonObject::ckCreate()
    If json.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ;  The salt is provided here as hex, overriding the default base64 for just this member.
    CkJsonObject::ckUpdateString(json,"salt","0102030405060708090a0b0c0d0e0f10")
    CkJsonObject::ckUpdateString(json,"saltEncoding","hex")

    ;  The pepper is supplied as UTF-8 text (its own characters are the bytes).
    CkJsonObject::ckUpdateString(json,"secret","application-wide-pepper")
    CkJsonObject::ckUpdateString(json,"secretEncoding","utf-8")

    ;  Associated data, supplied as UTF-8 text.
    CkJsonObject::ckUpdateString(json,"ad","user-id-42")
    CkJsonObject::ckUpdateString(json,"adEncoding","utf-8")

    CkJsonObject::ckUpdateString(json,"passwordCharset","utf-8")
    CkJsonObject::ckUpdateInt(json,"maxMemoryKb",1048576)
    CkJsonObject::ckUpdateInt(json,"keyLen",32)

    bdKey.i = CkBinData::ckCreate()
    If bdKey.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkCrypt2::ckArgon2DeriveKey(crypt,password,CkJsonObject::ckEmit(json),bdKey)
    If success = 0
        Debug CkCrypt2::ckLastErrorText(crypt)
        CkCrypt2::ckDispose(crypt)
        CkJsonObject::ckDispose(json)
        CkBinData::ckDispose(bdKey)
        ProcedureReturn
    EndIf

    keyHex.s = CkBinData::ckGetEncoded(bdKey,"hex")
    If CkBinData::ckLastMethodSuccess(bdKey) = 0
        Debug CkBinData::ckLastErrorText(bdKey)
        CkCrypt2::ckDispose(crypt)
        CkJsonObject::ckDispose(json)
        CkBinData::ckDispose(bdKey)
        ProcedureReturn
    EndIf

    Debug "Derived key: " + keyHex


    CkCrypt2::ckDispose(crypt)
    CkJsonObject::ckDispose(json)
    CkBinData::ckDispose(bdKey)


    ProcedureReturn
EndProcedure