Password-based encryption

import os
from argon2.low_level import hash_secret_raw, Type
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

password = b"correct horse battery staple"

salt = os.urandom(16)  # store with the ciphertext; not secret

# Argon2id -> 32-byte AES-256 key. Tune time_cost / memory_cost to ~hundreds of ms.
def derive(salt):
    return hash_secret_raw(password, salt, time_cost=3, memory_cost=64 * 1024,
                           parallelism=4, hash_len=32, type=Type.ID)

nonce = os.urandom(12)  # fresh per message
ciphertext = AESGCM(derive(salt)).encrypt(nonce, b"attack at dawn", None)

# Decrypt: re-derive the key from the password + stored salt.
plaintext = AESGCM(derive(salt)).decrypt(nonce, ciphertext, None)

import argon2 from 'argon2';
import { randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';

const password = 'correct horse battery staple';

const salt = randomBytes(16); // store with the ciphertext; not secret

// Argon2id -> 32-byte AES-256 key. raw:true returns the derived bytes, not a PHC string.
const opts = { type: argon2.argon2id, raw: true, salt, hashLength: 32,
               timeCost: 3, memoryCost: 64 * 1024, parallelism: 4 };
const key = await argon2.hash(password, opts);

const nonce = randomBytes(12); // fresh per message
const cipher = createCipheriv('aes-256-gcm', key, nonce);
const ct = Buffer.concat([cipher.update('attack at dawn', 'utf8'), cipher.final()]);
const tag = cipher.getAuthTag(); // store salt, nonce, tag and ct together

// Decrypt: re-derive the key from the password + stored salt.
const key2 = await argon2.hash(password, opts);
const decipher = createDecipheriv('aes-256-gcm', key2, nonce);
decipher.setAuthTag(tag);
const plaintext = Buffer.concat([decipher.update(ct), decipher.final()]);
console.log(plaintext.toString());

using System.Security.Cryptography;
using System.Text;
using Konscious.Security.Cryptography;

byte[] password = Encoding.UTF8.GetBytes("correct horse battery staple");
byte[] salt = RandomNumberGenerator.GetBytes(16); // store with the ciphertext; not secret

// Argon2id -> 32-byte AES-256 key. Tune Iterations / MemorySize to ~hundreds of ms.
static byte[] Derive(byte[] pw, byte[] salt) {
    using var kdf = new Argon2id(pw) {
        Salt = salt, DegreeOfParallelism = 4, MemorySize = 64 * 1024, Iterations = 3,
    };
    return kdf.GetBytes(32);
}

byte[] nonce = RandomNumberGenerator.GetBytes(12); // fresh per message
byte[] plaintext = Encoding.UTF8.GetBytes("attack at dawn");
byte[] ciphertext = new byte[plaintext.Length];
byte[] tag = new byte[16];
using (var aes = new AesGcm(Derive(password, salt), tag.Length))
    aes.Encrypt(nonce, plaintext, ciphertext, tag);

// Decrypt: re-derive the key from the password + stored salt.
byte[] decrypted = new byte[ciphertext.Length];
using (var aes = new AesGcm(Derive(password, salt), tag.Length))
    aes.Decrypt(nonce, ciphertext, tag, decrypted);

#include <sodium.h>
#include <cstring>
#include <string>
#include <vector>

// Argon2id -> 32-byte AES-256 key. INTERACTIVE limits suit a login; use
// _MODERATE / _SENSITIVE for higher-value data.
static void derive(unsigned char key[crypto_aead_aes256gcm_KEYBYTES],
                   const char *pw, const unsigned char *salt) {
    if (crypto_pwhash(key, crypto_aead_aes256gcm_KEYBYTES, pw, std::strlen(pw), salt,
            crypto_pwhash_OPSLIMIT_INTERACTIVE, crypto_pwhash_MEMLIMIT_INTERACTIVE,
            crypto_pwhash_ALG_ARGON2ID13) != 0) {
        throw std::bad_alloc(); // out of memory
    }
}

int main() {
    if (sodium_init() < 0) return 1;
    if (crypto_aead_aes256gcm_is_available() == 0) return 1; // needs AES-NI

    const char *password = "correct horse battery staple";
    std::string msg = "attack at dawn";

    unsigned char salt[crypto_pwhash_SALTBYTES]; // 16; store with the ciphertext
    randombytes_buf(salt, sizeof salt);

    unsigned char key[crypto_aead_aes256gcm_KEYBYTES];
    derive(key, password, salt);

    unsigned char nonce[crypto_aead_aes256gcm_NPUBBYTES]; // 12, fresh per message
    randombytes_buf(nonce, sizeof nonce);

    std::vector<unsigned char> ct(msg.size() + crypto_aead_aes256gcm_ABYTES);
    unsigned long long ct_len;
    crypto_aead_aes256gcm_encrypt(ct.data(), &ct_len,
        reinterpret_cast<const unsigned char *>(msg.data()), msg.size(),
        nullptr, 0, nullptr, nonce, key);

    // Decrypt: re-derive the key from the password + stored salt.
    unsigned char key2[crypto_aead_aes256gcm_KEYBYTES];
    derive(key2, password, salt);
    std::vector<unsigned char> pt(msg.size());
    unsigned long long pt_len;
    return crypto_aead_aes256gcm_decrypt(pt.data(), &pt_len, nullptr,
        ct.data(), ct_len, nullptr, 0, nonce, key2); // 0 on success
}

import de.mkammerer.argon2.Argon2Advanced;
import de.mkammerer.argon2.Argon2Factory;
import javax.crypto.Cipher;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.security.SecureRandom;

char[] password = "correct horse battery staple".toCharArray();
Argon2Advanced argon2 = Argon2Factory.createAdvanced(Argon2Factory.Argon2Types.ARGON2id);

byte[] salt = new byte[16];
new SecureRandom().nextBytes(salt); // store with the ciphertext; not secret

// Argon2id -> 32-byte AES-256 key (the Advanced factory's default hash length).
byte[] keyBytes = argon2.rawHash(3, 64 * 1024, 4, password, salt);
SecretKeySpec key = new SecretKeySpec(keyBytes, "AES");

byte[] nonce = new byte[12];
new SecureRandom().nextBytes(nonce); // fresh per message
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
cipher.init(Cipher.ENCRYPT_MODE, key, new GCMParameterSpec(128, nonce));
byte[] ciphertext = cipher.doFinal("attack at dawn".getBytes());

// Decrypt: re-derive the key from the password + stored salt.
SecretKeySpec key2 = new SecretKeySpec(argon2.rawHash(3, 64 * 1024, 4, password, salt), "AES");
Cipher dec = Cipher.getInstance("AES/GCM/NoPadding");
dec.init(Cipher.DECRYPT_MODE, key2, new GCMParameterSpec(128, nonce));
byte[] plaintext = dec.doFinal(ciphertext);

use aes_gcm::aead::{Aead, KeyInit};
use aes_gcm::{Aes256Gcm, Nonce};
use argon2::Argon2;
use rand::{rngs::OsRng, RngCore};

fn main() {
    let password = b"correct horse battery staple";

    let mut salt = [0u8; 16];
    OsRng.fill_bytes(&mut salt); // store with the ciphertext; not secret

    // Argon2id (default params) -> 32-byte AES-256 key.
    let mut key = [0u8; 32];
    Argon2::default()
        .hash_password_into(password, &salt, &mut key)
        .expect("argon2");

    let mut nonce_bytes = [0u8; 12];
    OsRng.fill_bytes(&mut nonce_bytes); // fresh per message
    let nonce = Nonce::from_slice(&nonce_bytes);
    let ciphertext = Aes256Gcm::new_from_slice(&key)
        .unwrap()
        .encrypt(nonce, b"attack at dawn".as_ref())
        .expect("encrypt");

    // Decrypt: re-derive the key from the password + stored salt.
    let mut key2 = [0u8; 32];
    Argon2::default().hash_password_into(password, &salt, &mut key2).expect("argon2");
    let plaintext = Aes256Gcm::new_from_slice(&key2)
        .unwrap()
        .decrypt(nonce, ciphertext.as_ref())
        .expect("wrong password or tampered data");
    assert_eq!(&plaintext, b"attack at dawn");
}