Verify an Argon2 Password with a Secret and Memory Guard

Demonstrates Crypt2.Argon2VerifyPassword when the hash was created with a secret (pepper) or ad, and the use of maxMemoryKb to guard against untrusted hash strings.

func chilkatTest() {
    let crypt = CkoCrypt2()!

    //  The password should come from a secure source rather than being hard-coded.
    var password: String? = "correct horse battery staple"

    var phcHash: String? = "$argon2id$v=19$m=131072,t=4,p=2$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM"

    //  When the hash was created with a secret (pepper) or ad, the same values must be supplied to verify.
    //  Only the secret, ad, encoding, passwordCharset, and maxMemoryKb members of the options are used;
    //  everything else is ignored.
    let json = CkoJsonObject()!
    json.updateString(jsonPath: "secret", value: "application-wide-pepper")
    json.updateString(jsonPath: "secretEncoding", value: "utf-8")

    //  maxMemoryKb guards against a hash from an untrusted source claiming an enormous memory cost.  The
    //  memory cost is taken from the hash string, so this limit is checked before any memory is allocated.
    //  It defaults to 2 GB.
    json.updateInt(jsonPath: "maxMemoryKb", value: 262144)

    //  Argon2VerifyPassword returns 1 if the password matched, 0 if it did not match, and -1 if the
    //  verification could not be performed.  Always test for a match with == 1.
    var verifyResult: Int = crypt.argon2VerifyPassword(password: password, json: json.emit(), phcHash: phcHash).intValue
    if verifyResult == 1 {
        print("The password is verified.")
    }
    else {
        if verifyResult == 0 {
            print("The password does not match.")
        }
        else {
            print("The verification could not be performed: \(crypt.lastErrorText!)")
        }

    }


}