Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account.
We are using Bcrypt to store customer's password in our DB, however Bcrypt (combined with Basic Auth) is quite slow on our servers. As far as I understand this is behavior by design, however there are cases when customer will be calling our API extensively and therefore Bcrypt would dramatically increase our response time (unfortunately this is a crutial customer criteria).
To tackle this problem I have found solution by using HMAC as in memory cache for all sucessfull passwords. In summary it would goes like this:
- Take from basic auth username and password
- HMAC(salt, username|password) where salt is 16 urandom bytes created at application startup
- check whether created HMAC has exists in memory cache
- if yes -> authenticate else -> check bcrypt mechanism with username and password and if successful store given HMAC hash into cache
So far this solution performs well with high throughput, however I am no security expert and therefore other opinion would be appriciated. So here are my questions
A) Is there some other solution with basic auth which would be better?
B) Is described solution HMAC -> BCRYPT secure?
