Improve p12 passphrase generation

[csirac2]

See

algo/playbooks/facts/main.yml

Line 32 in 8da53f8

easyrsa_p12_export_password: "{{ p12_export_password|default((ansible_date_time.iso8601_basic|sha1|to_uuid).split('-')[0]) }}"

Under the hood, ansible uses python's uuid5 function https://github.com/ansible/ansible/blob/7e71bdd3a0fd38b089464c884154e2152507d61f/lib/ansible/plugins/filter/core.py#L308

Which is implemented without adding any additional entropy of its own, unlike uuid4():
https://hg.python.org/cpython/file/2.7/Lib/uuid.py#l586

Which appears to result in deterministic output given the same input:

import uuid
>>> uuid.UUID(bytes='deadbeefdeadbeef', version=5)
UUID('64656164-6265-5566-a465-616462656566')
>>> uuid.UUID(bytes='deadbeefdeadbeef', version=5)
UUID('64656164-6265-5566-a465-616462656566')
>>> uuid.UUID(bytes='deadbeefdeadbeef', version=5)
UUID('64656164-6265-5566-a465-616462656566')

I could be wrong, but I worry that this reduces the entropy in p12 secrets to the time at which they were created

[csirac2]

The main problem with #655 is that it retains the 32-bit passwords, which my i7 laptop with https://github.com/crackpkcs12/crackpkcs12 seems to get 7,000/sec with (about a week of walltime for 2 cores).

[jackivanov]

Taking to account that we store the p12 password in plaintext, does this issue make any sense?

[csirac2]

Am I the only one that doesn't use mobileconfigs? :D I traditionally rely on .p12 certs not being trivially crackable, but perhaps I'm weird.

[csirac2]

FWIW this issue is already resolved via #655 and #657.

[jackivanov]

Yes, but we still need to get rid of plaintext passwords

[csirac2]

Understood - is it worth addressing that in a separate issue?