#!/usr/bin/perl
use strict;
use warnings;

use Data::Dumper;
$Data::Dumper::Useqq = 1;

# In reality, use a better algorithm, add salt, etc.
sub encrypt {
    my ($password, $passphrase) = @_;
    my $long_passphrase = $passphrase;
    $long_passphrase .= $passphrase
        until length($password) < length $long_passphrase;
    substr $long_passphrase, -1, 1, q()
        until length($password) == length $long_passphrase;

    return $password ^ $long_passphrase
}

*decrypt = *encrypt{CODE};


# This comes from the users.
my %real_passwords = ( john => 'pas$$w0rd',
                       jane => 'bailey2012',
);

# This comes from the admin.
my $passphrase = 'Perl FTW!';

# This gets saved in the DB.
my %stored_passwords = map {
    $_ => encrypt($real_passwords{$_}, $passphrase)
} keys %real_passwords;
print Dumper \%stored_passwords;

# When changing the passphrase, just update the passwords:
my $new_passphrase = 'Invalidate all passwords!';
$_ = encrypt(decrypt($_, $passphrase), $new_passphrase)
    for values %stored_passwords;
print Dumper \%stored_passwords;

# We can now retrieve the passwords using the new passphrase.
print Dumper +{
    map { $_ => decrypt($stored_passwords{$_}, $new_passphrase)
        } keys %stored_passwords
};