How secure is a 40 bytes hexadecimal string AES256 encrypted with 50 bytes random password Problem

Assume I have a 40 bytes hexadecimal ASCII string and a 50 bytes random password.



data: a7cd8558a341e3525d060e90fb37975efa8dd519
key:  ]*Úf"¢^¨¥GJþPÒYÅ9ÝÁ´!½OïæñÝ{/§@·]%¾âðNQn@:U2çþÇ&lt;uÓ


The data will be AES256 encrypted with the password. The encrypted data will be stored as a key-value pair and that key and the usage of it predicts the decrypted data represents a lower case 40 bytes hex value.

Question

What can I assume how secure the encrypted data will be?

Use case scenario

I'm using Ansible to provision my VM. One of the Ansible scripts uses my GitHub API token. The token is stored as an variable encrypted with AES256 by the Ansible Vault.

Now I'd like to store my Ansible scripts in my GitHub repository. But I'm not sure how much does it cost to decrypt the GitHub API token.
For reference, this is the Ansible Vault format. In short:


It derives an AES key, HMAC key and IV from the password using a 32-byte random salt
It encrypts the data using AES-CTR with the derived key and IV
It MACs the ciphertext (but not the IV) with HMAC-SHA256. Not including the IV is usually bad, but since the IV is derived from the password and salt and it's not stored with encrypted data, it seems OK.


As far as I know, this looks safe if the password is strong enough. In your case, what you call "key" seems to be the password, and is certainly long enough.