Encryption of Authentication Ticket

[Robert Millman]

i have a question regarding the encryption of an Authentication Ticket under FormsAuthentication. Can anyone tell me what type of encryption is used and what key(s) is it based on? I simply want to know that the encryption is specific to the machine and possible the ASP.NET application and cannot be decrypted by someone who has access to the .NET framework and can put the ticket through the FormsAuthentication.Deccrypt method

Thank

Robert Millman

[Hernan de Lahitte]

Forms Auth encrypts the ticket with 3DES by default and use a random
generated key stored in the LSA. If you wish, you can specify a base 64
encoded key in the <machineKey> element of the machine.config file or your
web.config file. (see decryptionKey attribute). In fact, the encryption key
is hashed with some extra timestamped entropy values in order to get
increased security against replay attacks and the like. You can find more
info about <machineKey> in
[url]http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpgenref/html/gngrfmachinekeysection.asp[/url].
You also have good tips in
[url]http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/THCMCh19.asp[/url]


--
Hernan de Lahitte
Lagash Systems S.A.
[url]http://www.lagash.com[/url]



"Robert Millman" <RMillman@AllscriptsOL.com> wrote in message
news:A9E7E207-2174-491A-8293-E3474475C0F8@microsoft.com...

> i have a question regarding the encryption of an Authentication Ticket

under FormsAuthentication. Can anyone tell me what type of encryption is
used and what key(s) is it based on? I simply want to know that the
encryption is specific to the machine and possible the ASP.NET application
and cannot be decrypted by someone who has access to the .NET framework and
can put the ticket through the FormsAuthentication.Deccrypt method.

>
> Thanks
>
> Robert Millman

[Robert Millman]

Thanks for answering my question. As I understand it, the ticket cannot be decrypted without the key, which is local/specific to the machine/config/app

Thank

[Hernan de Lahitte]

You are right. The exception is if you specify a decryptionKey in the
machineKey element of the config file, usually in web farm scenarios.

--
Hernan de Lahitte
Lagash Systems S.A.
[url]http://www.lagash.com[/url]



"Robert Millman" <RMillman@AllscriptsOL.com> wrote in message
news:F552145C-9C52-4EDD-9B2B-D903AA2191C5@microsoft.com...

> Thanks for answering my question. As I understand it, the ticket cannot

be decrypted without the key, which is local/specific to the
machine/config/app.

>
> Thanks
>
>