Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    DECLARE @crypt int
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @crypt OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    --  The password should come from a secure source rather than being hard-coded.
    DECLARE @password nvarchar(4000)
    SELECT @password = 'correct horse battery staple'

    --  Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
    --    secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
    --                   application and NOT stored with the hash, so a stolen hash database cannot be
    --                   attacked without it.
    --    ad             optional associated data X: additional non-secret data bound into the derivation.
    --    encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
    --                   saltEncoding, secretEncoding, and adEncoding.
    --    passwordCharset  the charset the password is converted to before use (default utf-8).
    --    maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
    --                   default 2097152 (2 GB).
    DECLARE @json int
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @json OUT

    --  The salt is provided here as hex, overriding the default base64 for just this member.
    EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'salt', '0102030405060708090a0b0c0d0e0f10'
    EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'saltEncoding', 'hex'

    --  The pepper is supplied as UTF-8 text (its own characters are the bytes).
    EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'secret', 'application-wide-pepper'
    EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'secretEncoding', 'utf-8'

    --  Associated data, supplied as UTF-8 text.
    EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'ad', 'user-id-42'
    EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'adEncoding', 'utf-8'

    EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'passwordCharset', 'utf-8'
    EXEC sp_OAMethod @json, 'UpdateInt', @success OUT, 'maxMemoryKb', 1048576
    EXEC sp_OAMethod @json, 'UpdateInt', @success OUT, 'keyLen', 32

    DECLARE @bdKey int
    EXEC @hr = sp_OACreate 'Chilkat.BinData', @bdKey OUT

    EXEC sp_OAMethod @json, 'Emit', @sTmp0 OUT
    EXEC sp_OAMethod @crypt, 'Argon2DeriveKey', @success OUT, @password, @sTmp0, @bdKey
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @json
        EXEC @hr = sp_OADestroy @bdKey
        RETURN
      END

    DECLARE @keyHex nvarchar(4000)
    EXEC sp_OAMethod @bdKey, 'GetEncoded', @keyHex OUT, 'hex'
    EXEC sp_OAGetProperty @bdKey, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 = 0
      BEGIN
        EXEC sp_OAGetProperty @bdKey, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @json
        EXEC @hr = sp_OADestroy @bdKey
        RETURN
      END

    PRINT 'Derived key: ' + @keyHex

    EXEC @hr = sp_OADestroy @crypt
    EXEC @hr = sp_OADestroy @json
    EXEC @hr = sp_OADestroy @bdKey


END
GO