I have an API that is handling a lot of volume and is using Basic authorization. This is causing me some performance issues and I'd like to move to token based auth but for various reasons, including problems forcing integrated parties to migrate to a new API version, I am unable to do so.
So, for the time being I'm stuck running Basic authorization on each request. Because I use bcrypt this takes a considerable amount of time (on average 70ms out of 350ms total response time). I understand that this is the correct way to hash passwords from a security standpoint so this is definitely something I want to keep but at the same time I'd like to optimize this so that I don't have to pay this 70ms penalty on my response times.
What I have so far is that I'd compute a SHA512 of the credentials combined with 2 peppers, use this as a cache key and check it for a record. If there's no record under the given hash then I would run the bcrypt authentication code and if successful save the result in the cache with 15 mins expiry. This way I'd save a considerable chunk of the response time when creds are valid and cached but force all invalid requests into bcrypt.
There are some issues around password resets/changes but they are not a huge deal and I have a solution for them. What I'm wondering is what are potential issues to this approach, especially from a security standpoint? If a malicious party was to obtain some of these hash values from my cache how hard would it be to bruteforce the credentials, assuming they cannot access the peppers?