I developed an application that is similar in concept to an FTP server. There are several hundred user accounts, and it uses bcrypt to store hashed passwords.
All user passwords are randomly-generated 128-bit v4 GUIDs.
One feature of my application causes many concurrent logins. When this happens, bcrypt dominates performance profiles and degrades the user experience. I want to reduce CPU load by replacing bcrypt with a less CPU-intensive hash function.
Web applications use bcrypt for passwords instead of much weaker hashes (e.g. single-round SHA-1, or even ROT13) so that offline cracking is suddenly nontrivial.
But, since an FTP-server-alike application just reads/writes files on the local disk, any attacker with access to the login database will have this local disk access anyway. So I don't think offline hash-cracking is a credible threat.
That just leaves online bruteforce, but since I'm lucky to have a guarantee of strong passwords (128-bit v4 GUIDs), that's really infeasible too.
So I think in this situation it's safe for me to downgrade the hash security to something significantly weaker (e.g. single-round SHA-1, or even ROT13).
My question is:
Have i forgotten something? Is this analysis wrong?