Ansible Vault - how does the encryption work?

Question

I was looking at Ansible Vault which is used for encryption in Ansible playbooks. The Ansible documentation seems to be thin on details of how it works, apart from mentioning that the default cipher is AES. I can't confidently figure it out myself from the source code.

I can see the result of using ansible-vault to encrypt a test file:

$ANSIBLE_VAULT;1.1;
AES256   
DIGITS   
DIGITS   
etc.  

I found this post which explains how to decrypt an Ansible-Vault-encrypted file using a patched version of openssl. Can anyone explain whether it's possible to decrypt an Ansible Vault file using vanilla tools not packaged with Ansible? (Assuming you know the password, of course).

Answer 1

Ansible is open source, written in Python, and uses PyCrypto, a standard python cryptography library, not packaged with Ansible.

https://www.dlitz.net/software/pycrypto/

The module that handles encryption and decryption is VaultLib, here:

https://github.com/ansible/ansible/blob/adea1f2b80d806d94ca1bdb2d06f2df077feb948/lib/ansible/parsing/vault/init.py

That module looks to have only minimal dependencies on other Ansible modules- some python 3 compatibility stuff, some unicode stuff, a module called Display.

To make a "standalone" tool with a high likelihood of compatibility with Ansible, the best approach would be to take that code, remove the python 3 stuff, remove the Display module, and copy-paste in the unicode functions.

As long as PyCrypto and other python dependencies are installed, the encrypt and decrypt functions in that module should just work.