Verify an Argon2 Password with a Secret and Memory Guard

Demonstrates Crypt2.Argon2VerifyPassword when the hash was created with a secret (pepper) or ad, and the use of maxMemoryKb to guard against untrusted hash strings.

#include <C_CkCrypt2W.h>
#include <C_CkJsonObjectW.h>

void ChilkatSample(void)
    {
    HCkCrypt2W crypt;
    const wchar_t *password;
    const wchar_t *phcHash;
    HCkJsonObjectW json;
    int verifyResult;

    crypt = CkCrypt2W_Create();

    //  The password should come from a secure source rather than being hard-coded.
    password = L"correct horse battery staple";

    phcHash = L"$argon2id$v=19$m=131072,t=4,p=2$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM";

    //  When the hash was created with a secret (pepper) or ad, the same values must be supplied to verify.
    //  Only the secret, ad, encoding, passwordCharset, and maxMemoryKb members of the options are used;
    //  everything else is ignored.
    json = CkJsonObjectW_Create();
    CkJsonObjectW_UpdateString(json,L"secret",L"application-wide-pepper");
    CkJsonObjectW_UpdateString(json,L"secretEncoding",L"utf-8");

    //  maxMemoryKb guards against a hash from an untrusted source claiming an enormous memory cost.  The
    //  memory cost is taken from the hash string, so this limit is checked before any memory is allocated.
    //  It defaults to 2 GB.
    CkJsonObjectW_UpdateInt(json,L"maxMemoryKb",262144);

    //  Argon2VerifyPassword returns 1 if the password matched, 0 if it did not match, and -1 if the
    //  verification could not be performed.  Always test for a match with == 1.
    verifyResult = CkCrypt2W_Argon2VerifyPassword(crypt,password,CkJsonObjectW_emit(json),phcHash);
    if (verifyResult == 1) {
        wprintf(L"The password is verified.\n");
    }
    else {
        if (verifyResult == 0) {
            wprintf(L"The password does not match.\n");
        }
        else {
            wprintf(L"The verification could not be performed: %s\n",CkCrypt2W_lastErrorText(crypt));
        }

    }



    CkCrypt2W_Dispose(crypt);
    CkJsonObjectW_Dispose(json);

    }