Verify an Argon2 Password with a Secret and Memory Guard

Demonstrates Crypt2.Argon2VerifyPassword when the hash was created with a secret (pepper) or ad, and the use of maxMemoryKb to guard against untrusted hash strings.

load ./chilkat.dll

set crypt [new_CkCrypt2]

#  The password should come from a secure source rather than being hard-coded.
set password "correct horse battery staple"

set phcHash "$argon2id$v=19$m=131072,t=4,p=2$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM"

#  When the hash was created with a secret (pepper) or ad, the same values must be supplied to verify.
#  Only the secret, ad, encoding, passwordCharset, and maxMemoryKb members of the options are used;
#  everything else is ignored.
set json [new_CkJsonObject]

CkJsonObject_UpdateString $json "secret" "application-wide-pepper"
CkJsonObject_UpdateString $json "secretEncoding" "utf-8"

#  maxMemoryKb guards against a hash from an untrusted source claiming an enormous memory cost.  The
#  memory cost is taken from the hash string, so this limit is checked before any memory is allocated.
#  It defaults to 2 GB.
CkJsonObject_UpdateInt $json "maxMemoryKb" 262144

#  Argon2VerifyPassword returns 1 if the password matched, 0 if it did not match, and -1 if the
#  verification could not be performed.  Always test for a match with == 1.
set verifyResult [CkCrypt2_Argon2VerifyPassword $crypt $password [CkJsonObject_emit $json] $phcHash]
if {$verifyResult == 1} then {
    puts "The password is verified."
} else {
    if {$verifyResult == 0} then {
        puts "The password does not match."
    }     else {
        puts "The verification could not be performed: [CkCrypt2_lastErrorText $crypt]"
    }

}


delete_CkCrypt2 $crypt
delete_CkJsonObject $json