In our web app we make good use of single use tokens. For example, when somebody creates any of the three "accounts", resets their password, or any other number of things that require random single-use tokens, we:
- Generate 32 random bytes from the OS' CSPRNG
- Base-64 URL encode it
- Store the hash in our database (Scrypt with N=2^15, r=8, P=1)
- Give the user the single-use token (usually in the form of a URL)
This all works fine. However, through profiling we've noticed that some of our API calls can take a couple seconds because they have to both verify and create tokens. Some API calls will use Scrypt three or more times.
While it's not terrible, we'd like to speed up the API calls if possible.
I've floated the idea of pre-generating some random tokens, but I'd like a second opinion before I go head and start on this.
There are two ways I think we could go about this. First, we'd simply create (token, hash, salt) triples and store them in-memory. The down side to this is we'd have the unencrypted tokens just sitting there, and an attacker could get them and use them. However, that'd require access to the specific AWS instance and single-use tokens would be the least of our concerns in that situation.
The second would be to use a vault of some kind, so the tuples are still sitting in-memory, but are encrypted. This sounds safer, but still requires the password to the vault to be sitting somewhere and so the attacker still would have access to it if she had access to the AWS instance.
Thoughts? I'm a little wary of this idea, but I'd really like to cut down some API calls from three seconds down to less than one second.