PureBasic Requires Chilkat v11.6.0+

Verify an Argon2 Password with a Secret and Memory Guard

Demonstrates Crypt2.Argon2VerifyPassword when the hash was created with a secret (pepper) or ad, and the use of maxMemoryKb to guard against untrusted hash strings.

Background. Only the secret, ad, encoding, passwordCharset, and maxMemoryKb options are used during verification; everything else is ignored. Because the memory cost is taken from the hash string, setting maxMemoryKb for hashes from an untrusted source prevents an enormous claimed cost from exhausting memory; it is checked before any allocation. The method returns 1 for a match, 0 for no match, and -1 if the verification could not be performed; always test for a match with == 1.

Chilkat PureBasic Downloads

Download Chilkat for PureBasic

PureBasic

IncludeFile "CkCrypt2.pb"
IncludeFile "CkJsonObject.pb"

Procedure ChilkatExample()

    crypt.i = CkCrypt2::ckCreate()
    If crypt.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ;  The password should come from a secure source rather than being hard-coded.
    password.s = "correct horse battery staple"

    phcHash.s = "$argon2id$v=19$m=131072,t=4,p=2$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM"

    ;  When the hash was created with a secret (pepper) or ad, the same values must be supplied to verify.
    ;  Only the secret, ad, encoding, passwordCharset, and maxMemoryKb members of the options are used;
    ;  everything else is ignored.
    json.i = CkJsonObject::ckCreate()
    If json.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkJsonObject::ckUpdateString(json,"secret","application-wide-pepper")
    CkJsonObject::ckUpdateString(json,"secretEncoding","utf-8")

    ;  maxMemoryKb guards against a hash from an untrusted source claiming an enormous memory cost.  The
    ;  memory cost is taken from the hash string, so this limit is checked before any memory is allocated.
    ;  It defaults to 2 GB.
    CkJsonObject::ckUpdateInt(json,"maxMemoryKb",262144)

    ;  Argon2VerifyPassword returns 1 if the password matched, 0 if it did not match, and -1 if the
    ;  verification could not be performed.  Always test for a match with == 1.
    verifyResult.i = CkCrypt2::ckArgon2VerifyPassword(crypt,password,CkJsonObject::ckEmit(json),phcHash)
    If verifyResult = 1
        Debug "The password is verified."
    Else
        If verifyResult = 0
            Debug "The password does not match."
        Else
            Debug "The verification could not be performed: " + CkCrypt2::ckLastErrorText(crypt)
        EndIf

    EndIf



    CkCrypt2::ckDispose(crypt)
    CkJsonObject::ckDispose(json)


    ProcedureReturn
EndProcedure