diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt
index d2f7f698d17..d6dbdeddf47 100644
--- a/hadoop-common-project/hadoop-common/CHANGES.txt
+++ b/hadoop-common-project/hadoop-common/CHANGES.txt
@@ -111,6 +111,9 @@ Release 2.6.0 - UNRELEASED
     HADOOP-10431. Change visibility of KeyStore.Options getter methods to
     public. (tucu)
 
+    HADOOP-10534. KeyProvider getKeysMetadata should take a list of names
+    rather than returning all keys. (omalley)
+
   OPTIMIZATIONS
 
     HADOOP-10838. Byte array native checksumming. (James Thomas via todd)
diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProvider.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProvider.java
index a8a303ce7b4..17ce33cfdb0 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProvider.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProvider.java
@@ -312,20 +312,16 @@ public abstract KeyVersion getKeyVersion(String versionName
 
 
   /**
-   * Get the key metadata for all keys.
-   *
-   * @return a Map with all the keys and their metadata
+   * Get key metadata in bulk.
+   * @param names the names of the keys to get
    * @throws IOException
    */
-  public Map<String, Metadata> getKeysMetadata() throws IOException {
-    Map<String, Metadata> keysMetadata = new LinkedHashMap<String, Metadata>();
-    for (String key : getKeys()) {
-      Metadata meta = getMetadata(key);
-      if (meta != null) {
-        keysMetadata.put(key, meta);
-      }
+  public Metadata[] getKeysMetadata(String... names) throws IOException {
+    Metadata[] result = new Metadata[names.length];
+    for (int i=0; i < names.length; ++i) {
+      result[i] = getMetadata(names[i]);
     }
-    return keysMetadata;
+    return result;
   }
 
   /**
diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyShell.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyShell.java
index aedcfc00e31..6bb982f3704 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyShell.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyShell.java
@@ -230,16 +230,16 @@ public boolean validate() {
     }
 
     public void execute() throws IOException {
-      List<String> keys;
       try {
+        List<String> keys = provider.getKeys();
         out.println("Listing keys for KeyProvider: " + provider.toString());
         if (metadata) {
-          Map<String, Metadata> keysMeta = provider.getKeysMetadata();
-          for (Map.Entry<String, Metadata> entry : keysMeta.entrySet()) {
-            out.println(entry.getKey() + " : " + entry.getValue());
+          Metadata[] meta =
+            provider.getKeysMetadata(keys.toArray(new String[keys.size()]));
+          for(int i=0; i < meta.length; ++i) {
+            out.println(keys.get(i) + " : " + meta[i]);
           }
         } else {
-          keys = provider.getKeys();
           for (String keyName : keys) {
             out.println(keyName);
           }