1
Aug 09

Strong Password Generator in Perl

Here is a simple and strong password generator in Perl.

#!/usr/bin/perl

print "Script PASS: ";

chomp(my $salt = <STDIN>);

{

print "Enter keyword: ";

chomp(my $string = <STDIN>); #Take the input from the user and remove the n

last if $string eq 'q';

my $encrypted_string = crypt($string,$salt); #take the string and the salt and put through crypt()

print $encrypted_string.'Z'."\n\n"; #Change Z to something else for additional security.

redo;

}

How does it work. First, we have assumed you are on Linux, of course :) If not, you will probably require ActivePerl.

First, the script asks you for the script password. This password will be the Salt for the hash generation.  This means that without the main password the generated hashes will be incorrect. However, if someone knows your main password, it is not enough. He will also need the script.

Once your enter the main password, you will be asked for a keyword to generate the hash for. For example, if you have an account in example.org you can generate its password with the keyword 'example.org'.

Needless to say, you will be generating / using different passwords for the different accounts / sites. This is a good practice but can be quite confusing if your don't automate it :)

In the hash generation, there is a Z added. This is like a personal token which must be customized for better protection.

This script will ensure your passwords (generated hashes) are very strong, still easily retrievable :) Even if someone finds a password for your account, it will be absolutely impossible to find another one. An attacker will need to gain at least a few passwords and chances are not big to reproduce a password for a different account.

Also the script will leave no traces / history about the job. So you will not expose your hyper-turbo-ultra secure password to someone who can just read your bash history for example.

Last but not least, you don't have to run the script anew each time you need a password for something. It is stuck in a loop until you press 'q' of course :)

The only drawback is that it shows the main password and someone could peek over your shoulders :) This could be resolved but will require additional perl modules and makes it hard to port the script to a new system...