When stretching the key for vault files, use PBKDF2HMAC() from the
cryptography package instead of pycrypto. This will speed up the opening
of vault files by ~10x.
The problem is here in lib/ansible/utils/vault.py:
hash_function = SHA256
# make two keys and one iv
pbkdf2_prf = lambda p, s: HMAC.new(p, s, hash_function).digest()
derivedkey = PBKDF2(password, salt, dkLen=(2 * keylength) + ivlength,
count=10000, prf=pbkdf2_prf)
`PBKDF2()` calls a Python callback function (`pbkdf2_pr()`) 10000 times.
If one has several vault files, this will cause excessive start times
with `ansible` or `ansible-playbook` (we experience ~15 second startup
times).
Testing the original implementation in 1.9.2 with a vault file:
In [2]: %timeit v.decrypt(encrypted_data)
1 loops, best of 3: 265 ms per loop
Having a recent OpenSSL version and using the vault.py changes in this commit:
In [2]: %timeit v.decrypt(encrypted_data)
10 loops, best of 3: 23.2 ms per loop
| Name |
Last commit
|
Last update |
|---|---|---|
| bin | Loading commit data... | |
| contrib | Loading commit data... | |
| docs/man | Loading commit data... | |
| docsite | Loading commit data... | |
| examples | Loading commit data... | |
| hacking | Loading commit data... | |
| lib/ansible | Loading commit data... | |
| packaging | Loading commit data... | |
| samples | Loading commit data... | |
| test | Loading commit data... | |
| ticket_stubs | Loading commit data... | |
| v1 | Loading commit data... | |
| .coveragerc | Loading commit data... | |
| .gitattributes | Loading commit data... | |
| .gitignore | Loading commit data... | |
| .gitmodules | Loading commit data... | |
| .travis.yml | Loading commit data... | |
| CHANGELOG.md | Loading commit data... | |
| CODING_GUIDELINES.md | Loading commit data... | |
| CONTRIBUTING.md | Loading commit data... | |
| COPYING | Loading commit data... | |
| ISSUE_TEMPLATE.md | Loading commit data... | |
| MANIFEST.in | Loading commit data... | |
| Makefile | Loading commit data... | |
| README.md | Loading commit data... | |
| RELEASES.txt | Loading commit data... | |
| VERSION | Loading commit data... | |
| setup.py | Loading commit data... | |
| test-requirements.txt | Loading commit data... | |
| tox.ini | Loading commit data... |