Your main problem with keeping an encrypted string in your program, is that most encrypted output is binary, and not printable. So.... you will need a technique to base64encode the encrypted output, THEN base64decode the string back to binary, before decryption. Pack and unpack could also be used.

You could also hide your key in plain site, but hidden in your script, like seek to line 42, and grab the 3rd word. :-) Few novices would follow the code to the the key, but its poor security.

Here are the basic techniques. You will find that anyone who knows even a bit of Perl, will be able to hack this. You cannot decrypt a password in a script, without the password being in the script somewhere. You can use RSA keys, to decrypt a key, because the RSA key is in another file, but that depends on home directories, user groups, and permissions setup correctly. Your easiest bet is to use a technique like pack() or MIME_BASE64 to just obscure your key.

#!/usr/bin/perl
use warnings;
use strict;
use Crypt::CBC;
use MIME::Base64;


my $KEY = 'secret_foo';
my $string = 'yadda yadda yadda yadda';
print "input: $string\n";

my $enc = encryptString( $string );
print "encrypted binary: $enc\n";

my $mime = encode_base64($enc);
print "MIME: $mime\n";

my $mime_decode = decode_base64($mime);
print "MIME_decode: $mime_decode\n";

my $dec = decryptString( $enc );
print "decrypted: $dec\n";

my $mime_dec = decryptString( decode_base64($mime) );
print "decrypted_mime: $mime_dec\n";

############################################################
sub encryptString {
   my $string = shift;
  
   my $cipher = Crypt::CBC->new(
      -key        => $KEY,
      -cipher     => 'Blowfish',
      -padding  => 'space',
      -add_header => 1
   );

   my $enc = $cipher->encrypt( $string  );
   return $enc; 
}

###################################################################

sub decryptString {
   my $string = shift;
   
   my $cipher = Crypt::CBC->new(
      -key        => $KEY,
      -cipher     => 'Blowfish',
      -padding  => 'space',
      -add_header => 1
   );

   my $dec = $cipher->decrypt( $string  );
   return $dec; 
}

#############################################################3
[download]

#!/usr/bin/perl
use warnings;
use strict;
#by fokat of perlmonks

my $string = 'justanotherperlhacker';
print "$string\n";

my $obscure =  pack("u",$string);
print "$obscure\n";

my $unobscure = unpack(chr(ord("a") + 19 + print ""),$obscure);

print "$unobscure\n";
[download]

Thanks Zentara. I did come across the CryptCBC and MIMEBase64 Modules and knew that this would somehow work, but I could not get what i wanted. your examples will definitely help me. this is what i wanted. thank you very much.

The thing about passwords is that you don't need to encrypt/decrypt them. Instead, all you need to do is store a cryptographic hash (also known as a "message digest") of the password. A hash cannot be 'decrypted' back to the original plain text but when you want to validate a login attempt, you just hash the supplied password and compare the result to the hash you have stored.

So for example if you want to accept the password "SmokeScreen" you might use the SHA1 hashing algorithm like this:

use Digest::SHA1 qw(sha1_hex);

print sha1_hex("SmokeScreen"), "\n";

# Prints "95cb0bfd2977c761298d9624e4b4d4c72a39974a"
[download]

You could then store this 40 character string.

Later when someone attempts to log in they'll provide a plaintext password which you'll feed through the same sha1_hex function and if the result is the same 40 character string then they obviously supplied the right password.

A flaw with this plan is that if two people have the same password then they'll have the same 40 character hash (even on another server that uses the same hashing algorithm) - this could be useful information to an attacker.

A slightly more complex approach is to generate a few bytes of random "salt" when you initially hash the password. You'll add the salt bytes on the start of the plaintext before hashing and also on the start of the hash that you store. Then to validate a password you take the salt value from the stored hash and add it on the start of what the user provides. Because the salt bytes are random at the time the password is initially set, then two people with the same password will have different hash values.

thanks grantm. What you have suggested can get me my head spinning towards a whole new approach. I will play around in my spare time. That's a really good suggestion. thanks.

You can check out Crypt::SaltedHash which implements this - http://search.cpan.org/~esskar/Crypt-SaltedHash-0.06/lib/Crypt/SaltedHash.pm

I am not sure whether I really want what you have asked. But I have to pass the REAL password to my application because it will never recognize a crypted password. BTW, I am logging to my application with my Active Directory Account and hence I am providing the my AD password in clear text format in my script. So I wanted not to write it in clear text and rather have it in the encrypted form and then decrypt it on the fly every time the script runs. THis is the reason I need a decryption mechanism.

Please do let me know if am thinking in wrong direction.

What makes this more secure than storing passwords in plain text? If a program can automatically decrypt the passwords, an attacker can as well - he'd just run the program. Of course, you could protect the "encrypted" password with a password, but than you're back to the beginning, aren't you?

If you need to authenticate your users against a LDAP (like Active Directory), you have not to store user's passwords at all. You need not to store them.

You need to use LDAP authentication for your appliation, when the user insert the login/password pair, you forward these info to Active Directory and if it confirms you know that the user is authenticated in that system.