I'm looking for a low CPU intensive encryption algorithm, to pass around session authentication tokens.
As an example:
- The user will login in to the website (via OAuth, whether by the site as provider or an external provider)
- Regardless of how they were originally authenticated, a new, randomly produced session token (in this case a 64 character length string) is associated with their account and is stored in a cookie.
- On each new page request, the session token is taken from the cookie, encrypted with a time-based nonce (to prevent replay) and placed in the headers as a meta tag and rendered.
- The API receives the params, takes out the encrypted info and decrypts it.
- Stuff happens…
Obviously, this could end up in a lot of encryption. Granted, the data will only be small, but it's the volume that worries me. To that end I'm looking for an encryption algorithm that:
- Is low on the CPU use
- Widely available would be nice.
- Easy to use would be nice.
I've had a look around, but the detail of some of the comparisons I've seen is beyond my knowledge to be entirely helpful. If anyone could give a suggestion, that would be helpful. Also, if anyone sees a glaring hole with the security in the above example, please let me know.
Extra info due to the comments:
- SSL would be used for all communication.
- The (whole) cookie is encrypted using AES. The specific key value pairs are not.
- I don't wish to manipulate the value using the browser, I want the already encrypted value to be sent via AJAX and then decrypted server side in the data API.
- I don't wish the user themselves to have access to an unencrypted session token.
- Most state is kept in the database, the session token is just there to let the API know who's making requests. Barely anything else is kept client side.
The main reason for this kind of set up is to allow many different clients to access the API via HTTPS, whether it's web or mobile or whatever, so the data API server may not reside on the same box as the website, and the website has no direct access to the database.