Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

func chilkatTest() {
    var success: Bool = false

    let crypt = CkoCrypt2()!

    //  The password should come from a secure source rather than being hard-coded.
    var password: String? = "correct horse battery staple"

    //  Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
    //    secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
    //                   application and NOT stored with the hash, so a stolen hash database cannot be
    //                   attacked without it.
    //    ad             optional associated data X: additional non-secret data bound into the derivation.
    //    encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
    //                   saltEncoding, secretEncoding, and adEncoding.
    //    passwordCharset  the charset the password is converted to before use (default utf-8).
    //    maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
    //                   default 2097152 (2 GB).
    let json = CkoJsonObject()!

    //  The salt is provided here as hex, overriding the default base64 for just this member.
    json.updateString(jsonPath: "salt", value: "0102030405060708090a0b0c0d0e0f10")
    json.updateString(jsonPath: "saltEncoding", value: "hex")

    //  The pepper is supplied as UTF-8 text (its own characters are the bytes).
    json.updateString(jsonPath: "secret", value: "application-wide-pepper")
    json.updateString(jsonPath: "secretEncoding", value: "utf-8")

    //  Associated data, supplied as UTF-8 text.
    json.updateString(jsonPath: "ad", value: "user-id-42")
    json.updateString(jsonPath: "adEncoding", value: "utf-8")

    json.updateString(jsonPath: "passwordCharset", value: "utf-8")
    json.updateInt(jsonPath: "maxMemoryKb", value: 1048576)
    json.updateInt(jsonPath: "keyLen", value: 32)

    let bdKey = CkoBinData()!
    success = crypt.argon2DeriveKey(password: password, json: json.emit(), bdKey: bdKey)
    if success == false {
        print("\(crypt.lastErrorText!)")
        return
    }

    var keyHex: String? = bdKey.getEncoded(encoding: "hex")
    if bdKey.lastMethodSuccess == false {
        print("\(bdKey.lastErrorText!)")
        return
    }

    print("Derived key: \(keyHex!)")

}