Could the validationKey and decryptionKey be found by brute force from the encrypted cookie value?
I am using the following code to generate an encrypted token:
var ticket = new System.Web.Security.FormsAuthenticationTicket(
2,
"",
DateTime.Now,
DateTime.Now.AddMinutes(10),
false,
"user id here");
var cipherText = System.Web.Security.FormsAuthentication.Encrypt(ticket);
This code uses the key and algorithm specified in app / web.config:
<system.web>
<machineKey validationKey="SOME KEY"
decryptionKey="SOME OTHER KEY"
validation="SHA1" />
</system.web>
Now, suppose I give the resulting ciphertext to my partner. Is she capable of gross coercion:
- The value that is stored in the cipher (user ID, which is not confidential information, and that doesn't bother me much)
- The validationKey and decryptionKey value used to create the encryption (which would be disastrous because it could generate tokens and impersonate any user).
I suppose the answer to both questions is yes, but how realistic are his chances and do you think giving him encryption would pose a security risk to my system? Thanks in advance for your answers.
a source to share
What you are describing here is a famous plaintext attack. The attacker examines both the plaintext and the corresponding ciphertexts, and his goal is to find the keys. Modern ciphers are designed to protect against such attacks.
Virtually any modern cipher is designed to defend against even more powerful attacks, such as selected plaintext attacks and selected ciphertext attacks. Even if an attacker is allowed to select the plaintext and the corresponding ciphertext, or select any number of ciphertexts and study its decryption, then he / she will still not be able to find out the key.
This greatly simplifies the design of a new cipher. But luckily, we already have good ciphers like AES.
I should also add that all of the attacks above assume that the attacker knows all the details of the encryption used. The only thing he doesn't know is the key that is being used. This is known as the Kerkhoff principle.
a source to share