Verify an Argon2 Password with a Secret and Memory Guard

Demonstrates Crypt2.Argon2VerifyPassword when the hash was created with a secret (pepper) or ad, and the use of maxMemoryKb to guard against untrusted hash strings.

const std = @import("std");
const chilkat = @import("chilkat");

pub fn main(init: std.process.Init) !void {
    const alloc = init.arena.allocator();

    const crypt = try chilkat.Crypt2.init();
    defer crypt.deinit();

    // The password should come from a secure source rather than being hard-coded.
    const password = "correct horse battery staple";

    const phc_hash = "$argon2id$v=19$m=131072,t=4,p=2$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM";

    // When the hash was created with a secret (pepper) or ad, the same values must be supplied to verify.
    // Only the secret, ad, encoding, passwordCharset, and maxMemoryKb members of the options are used;
    // everything else is ignored.
    const json = try chilkat.JsonObject.init();
    defer json.deinit();
    json.updateString("secret", "application-wide-pepper") catch {};
    json.updateString("secretEncoding", "utf-8") catch {};

    // maxMemoryKb guards against a hash from an untrusted source claiming an enormous memory cost.  The
    // memory cost is taken from the hash string, so this limit is checked before any memory is allocated.
    // It defaults to 2 GB.
    json.updateInt("maxMemoryKb", 262144) catch {};

    // Argon2VerifyPassword returns 1 if the password matched, 0 if it did not match, and -1 if the
    // verification could not be performed.  Always test for a match with == 1.
    const verify_result = crypt.argon2VerifyPassword(password, try json.emit(alloc), phc_hash);
    if (verify_result == 1) {
        std.debug.print("The password is verified.\n", .{});
    } else {
        if (verify_result == 0) {
            std.debug.print("The password does not match.\n", .{});
        } else {
            std.debug.print("The verification could not be performed: {s}\n", .{try crypt.getLastErrorText(alloc)});
        }
    }
}