What is the best password encryption & decryption library to use with Perl?

Question

I am writing a perl script that manipulates password protected zip files. Consequently I need to store & retrieve passwords to do this. I have three options for storing the password:

1. Store in plain text. Before you jump in, I have pretty much ruled out this option.
2. Use a simple password munger to prevent casual/accidental access (even by the DBAs)
3. Use a proper encryption/decryption library, such as Blowfish or AES.

Whatever I choose must run in Perl, under Windows and be easy to use.

Any suggestions?

Answer 1

The main problem with approach 3 is that, where do you store the key to the file that does contain the passwords? You could use Base64 for approach 2 but that very easy to "decrypt".

Answer 2

There should be no question here. You must use a sufficiently strong encryption scheme. You are being entrusted with sensitive data, and you must do everything possible to secure it.

If you are using Windows, you can leverage DPAPI to encrypt the AESkey and have it stored in the registry. Perl has modules to interact with Win32 libraries.

Best encryption is subjective, however AES 128 is sufficiently strong as of Jan 2009 to encrypt your data.

Even the best encryption schemes can be defeated if the user does not fully understand what they are doing.

Answer 3

There are a few Perl encryption packages that run on Windows, you can download the PPMs with ActivePerl package manager.

You can also use the pure Perl version of those modules (look for the name ending in _PP).

I found those on CPAN:

• Crypt::Blowfish
• Crypt::Rijndael