c/c++ passphrase entry

[qleak]

I'm working on an experimental crypto program and want to have the user input a passphrase, but don't want it to be displayed.

I would like for there to be * characters or just a curser moving over with a blank.

I'm fairly sure I can do this with ncurses but this seems like using a bulldozer to crack a peanut.

Also when I use the endwin() command it clears the input (for example the following code
with g++ -lncurses

Code: Select all

#include <iostream>
#include <curses.h>

using namespace std;


int main() {
  string password;
  initscr();
  noecho();
  cout << "Enter Passphrase:\n";
  cin >> password;
  cout << "You will not see this\n";
  endwin();
  cout << "Passphrase entered successfully\n";
}

I could obviously use the getch() function inculded with ncurses to make the curser move or put in * characters
with a bit more work.


Anyone have any comments or other solutions for this?

Thanks in advance.

-Q

[dayul]

Without curses you can do something like this:

Code: Select all

#include <iostream>
#include <string>
#include <termios.h>

using namespace std;

int main()
{
	struct termios tstored, tnew;
	string password;

	cout << "enter password" << endl;

	/*store old settings and set new ones*/
	tcgetattr(0, &tstored);
	tnew= tstored;
	tnew.c_lflag&= (~ECHO);
	tcsetattr(0, TCSANOW, &tnew);

	cin >> password;

	cout << "password is " << password << endl;

	/*restore old settings*/
	tcsetattr(0, TCSANOW, &tstored);

	return(0);
}

[dayul]

I also forgot to add that you can probably use the getpass() function, you would need to include unistd.h.
Both solutions probably depend on how portable you want it to be. Like you said, with ncurses getch() would probably be your best bet.

[Genone]

If you don't like the additional ncurses dep you can also control the echo behavior with the glibc terminal interface, just needs a bit more code (see `info libc terminal`)

[qleak]

Thanks both for you input. termios.h looks like a much simpler option that ncurses.

-Q