Is Forms Authentication Ticket safe enough?

*爱你&永不变心* 提交于 2019-12-03 03:05:54

ASP.NET forms authentication tickets are encrypted using the Rijndael algorithm. Rijndael was created as a replacement for DES (Data Encryption Standard) which offered unlimited ways to encrypt data and was also susceptible to brute force attacks. A number of DES Challenge were organised in the late 90's by RSA Security to challenge teams to crack DES in order to highlight its inherent vulnerabilities: http://en.wikipedia.org/wiki/DES_Challenges

By comparison Rijndael (also known as Advanced Encryption Standard AES) uses longer keys - 256bits and a double encrption algorithm. To crack a 256 bit Rijndael key (such as the ASP.NET machine key) would require 2^200 operations (about 10^60 - ten with 60 zeros), near impossible to brute force crack. Combine that with the fact that the ASP.NET ticket changes regularly, and when decrypted basically looks like a random string of letters and numbers (so impossible to determine if what you've brute force decrypted is correct or not) you can rest assured nobody will be cracking your forms authentication cookie any time soon.

More info about Rijndael and its possible attacks here:

http://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Known_attacks

The first rule of encryption is that the message is only as secure as the key. If someone has access to your key there is no method secure enough.

  1. I doubt it is possible to brute-force the Machine Key in any reasonable time.
  2. I believe Fomrs Authentication is the only true web solution that comes out of the box in ASP.NET. You can implement your own but I doubt it will be more secure.
  3. Safe enough for what? It is hijackable by a man in the middle in non-encrypted connection and vulnerable to XSRF attacks if you turn off event validation (in Web Forms) or don't use the security tokens (MVC). Otherwise it is secure safe for exploits that are discovered and fixed all the time in all technologies.
易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!