Xbase++ Requires Chilkat v11.6.0+

Verify an Argon2 Password with a Secret and Memory Guard

Demonstrates Crypt2.Argon2VerifyPassword when the hash was created with a secret (pepper) or ad, and the use of maxMemoryKb to guard against untrusted hash strings.

Background. Only the secret, ad, encoding, passwordCharset, and maxMemoryKb options are used during verification; everything else is ignored. Because the memory cost is taken from the hash string, setting maxMemoryKb for hashes from an untrusted source prevents an enormous claimed cost from exhausting memory; it is checked before any allocation. The method returns 1 for a match, 0 for no match, and -1 if the verification could not be performed; always test for a match with == 1.

Chilkat Xbase++ Downloads

Download Chilkat for Xbase++

Xbase++

LOCAL oCrypt
LOCAL cPassword
LOCAL cPhcHash
LOCAL oJson
LOCAL nVerifyResult

oCrypt := CreateObject("Chilkat.Crypt2")

//  The password should come from a secure source rather than being hard-coded.
cPassword := "correct horse battery staple"

cPhcHash := "$argon2id$v=19$m=131072,t=4,p=2$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM"

//  When the hash was created with a secret (pepper) or ad, the same values must be supplied to verify.
//  Only the secret, ad, encoding, passwordCharset, and maxMemoryKb members of the options are used;
//  everything else is ignored.
oJson := CreateObject("Chilkat.JsonObject")
oJson:UpdateString("secret", "application-wide-pepper")
oJson:UpdateString("secretEncoding", "utf-8")

//  maxMemoryKb guards against a hash from an untrusted source claiming an enormous memory cost.  The
//  memory cost is taken from the hash string, so this limit is checked before any memory is allocated.
//  It defaults to 2 GB.
oJson:UpdateInt("maxMemoryKb", 262144)

//  Argon2VerifyPassword returns 1 if the password matched, 0 if it did not match, and -1 if the
//  verification could not be performed.  Always test for a match with == 1.
nVerifyResult := oCrypt:Argon2VerifyPassword(cPassword, oJson:Emit(), cPhcHash)
IF (nVerifyResult == 1)
    ? "The password is verified."
ELSE
    IF (nVerifyResult == 0)
        ? "The password does not match."
    ELSE
        ? "The verification could not be performed: " + oCrypt:LastErrorText
    ENDIF

ENDIF

oCrypt:destroy()
oJson:destroy()