Verify an Argon2 Password with a Secret and Memory Guard

Demonstrates Crypt2.Argon2VerifyPassword when the hash was created with a secret (pepper) or ad, and the use of maxMemoryKb to guard against untrusted hash strings.

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @crypt int
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @crypt OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    --  The password should come from a secure source rather than being hard-coded.
    DECLARE @password nvarchar(4000)
    SELECT @password = 'correct horse battery staple'

    DECLARE @phcHash nvarchar(4000)
    SELECT @phcHash = '$argon2id$v=19$m=131072,t=4,p=2$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM'

    --  When the hash was created with a secret (pepper) or ad, the same values must be supplied to verify.
    --  Only the secret, ad, encoding, passwordCharset, and maxMemoryKb members of the options are used;
    --  everything else is ignored.
    DECLARE @json int
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @json OUT

    DECLARE @success int
    EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'secret', 'application-wide-pepper'
    EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'secretEncoding', 'utf-8'

    --  maxMemoryKb guards against a hash from an untrusted source claiming an enormous memory cost.  The
    --  memory cost is taken from the hash string, so this limit is checked before any memory is allocated.
    --  It defaults to 2 GB.
    EXEC sp_OAMethod @json, 'UpdateInt', @success OUT, 'maxMemoryKb', 262144

    --  Argon2VerifyPassword returns 1 if the password matched, 0 if it did not match, and -1 if the
    --  verification could not be performed.  Always test for a match with == 1.
    DECLARE @verifyResult int
    EXEC sp_OAMethod @json, 'Emit', @sTmp0 OUT
    EXEC sp_OAMethod @crypt, 'Argon2VerifyPassword', @verifyResult OUT, @password, @sTmp0, @phcHash
    IF @verifyResult = 1
      BEGIN

        PRINT 'The password is verified.'
      END
    ELSE
      BEGIN
        IF @verifyResult = 0
          BEGIN

            PRINT 'The password does not match.'
          END
        ELSE
          BEGIN

            EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
            PRINT 'The verification could not be performed: ' + @sTmp0
          END
      END

    EXEC @hr = sp_OADestroy @crypt
    EXEC @hr = sp_OADestroy @json


END
GO