Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

const std = @import("std");
const chilkat = @import("chilkat");

pub fn main(init: std.process.Init) !void {
    const alloc = init.arena.allocator();

    const crypt = try chilkat.Crypt2.init();
    defer crypt.deinit();

    // The password should come from a secure source rather than being hard-coded.
    const password = "correct horse battery staple";

    // Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
    //   secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
    //                  application and NOT stored with the hash, so a stolen hash database cannot be
    //                  attacked without it.
    //   ad             optional associated data X: additional non-secret data bound into the derivation.
    //   encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
    //                  saltEncoding, secretEncoding, and adEncoding.
    //   passwordCharset  the charset the password is converted to before use (default utf-8).
    //   maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
    //                  default 2097152 (2 GB).
    const json = try chilkat.JsonObject.init();
    defer json.deinit();

    // The salt is provided here as hex, overriding the default base64 for just this member.
    json.updateString("salt", "0102030405060708090a0b0c0d0e0f10") catch {};
    json.updateString("saltEncoding", "hex") catch {};

    // The pepper is supplied as UTF-8 text (its own characters are the bytes).
    json.updateString("secret", "application-wide-pepper") catch {};
    json.updateString("secretEncoding", "utf-8") catch {};

    // Associated data, supplied as UTF-8 text.
    json.updateString("ad", "user-id-42") catch {};
    json.updateString("adEncoding", "utf-8") catch {};

    json.updateString("passwordCharset", "utf-8") catch {};
    json.updateInt("maxMemoryKb", 1048576) catch {};
    json.updateInt("keyLen", 32) catch {};

    const bd_key = try chilkat.BinData.init();
    defer bd_key.deinit();
    crypt.argon2DeriveKey(password, try json.emit(alloc), bd_key) catch {
        std.debug.print("{s}\n", .{try crypt.getLastErrorText(alloc)});
        return;
    };

    const key_hex = bd_key.getEncoded(alloc, "hex") catch {
        std.debug.print("{s}\n", .{try bd_key.getLastErrorText(alloc)});
        return;
    };

    std.debug.print("Derived key: {s}\n", .{key_hex});
}