As others have pointed out, following the spirit of this policy is impossible. However, following the letter of the policy may not be impossible, and in fact could be as simple as this:

Store in your code two strings of the same length, some length longer than the password. At runtime, xor the strings together using perl's a-string-is-a-bitvector feature. The strings will have been chosen so that the result is the desired password.

Okay, that's one level. Now, what I would suggest is that you in addition write a script that prompts for a password, and mangles some other script to include the password as two variables as above. (Probably through something as simple as s/__RANDOM_STRING__/$randstr/; s/__PASS_XOR_RAND__/$pass^$randstr/e;) Then, this automatically runs pp over the mangled version, and deletes the mangled script. Call this second script your "build script".

This has the advantage that the password is in plaintext only in the memory image of the running program, and is not even deriveable from the source as it sits in your source control. The password is deriveable from the compiled executeable, but that's a necessity.

Of course, you don't need to use xor "encryption"; this method can easily be adapted to use Blowfish or AES or some other cryptographic standard that sounds impressive. (But really, what do you gain?)

Anyone ever think that some policy like this is behind the rot13-encrypted data in the windows registry? 

--
@/=map{[/./g]}qw/.h_nJ Xapou cets krht ele_ r_ra/;
map{y/X_/\n /;print}map{pop@$_}@/for@/

[download]

In reply to Re: Security: balancing two conflicting password policies by fizbin
in thread Security: balancing two conflicting password policies by radiantmatrix

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.