I would like to point out that this scheme is quite insecure. If someone grabs your file, your security is toast. A much more robust approach has been devised by the fine folks at Bellcore and is discussed here and here. Those documents contain a nice description of how this scheme works.

In layman terms, what you do is choose a 'seed' phrase and the number of keys to generate. Then you apply a secure hash algorithm to the seed phrase said number of times. In the reference I mentioned before, they talk about MD4. Nowadays, MD5 (and for some applications, MD160) are better options.

With this scheme, your server would just need to keep track of the last succesfully authenticated key and its sequence, as all of them can be generated by using the pass or seed phrase, which might be easier to hide or protect. This has the added benefit that the legitimate users, knowing the seed phrase, could use automated means to generate the required key.

A quick search on CPAN reveals that a lot of the work as already been done.

Hope this helps.