Is Forms Authentication Ticket safe enough?
When a user logs in based on default Forms Authentication method, the server creates a cookie containing encrypted data (using Machine Key as key for encryption).
It means that if someone find/guess/access Machine Key for the server, he will be logged in to the web application.
I've developed some applications which are on 4 servers. So, I hard-coded the same Machine Key for all the servers in machine.config and I can't use Auto Generate mode.
- Is it possible to brute force the Machine Key?
- Is there any other methods? (I don't want to use Windows and Passport)
- And is Forms Authentication Ticket safe enough? (i.e. acceptable for e-banking applications)
Answer
ASP.NET forms authentication tickets are encrypted using the Rijndael algorithm. Rijndael was created as a replacement for DES (Data Encryption Standard) which offered unlimited ways to encrypt data and was also susceptible to brute force attacks. A number of DES Challenge were organised in the late 90's by RSA Security to challenge teams to crack DES in order to highlight its inherent vulnerabilities: http://en.wikipedia.org/wiki/DES_Challenges
By comparison Rijndael (also known as Advanced Encryption Standard AES) uses longer keys - 256bits and a double encrption algorithm. To crack a 256 bit Rijndael key (such as the ASP.NET machine key) would require 2^200 operations (about 10^60 - ten with 60 zeros), near impossible to brute force crack. Combine that with the fact that the ASP.NET ticket changes regularly, and when decrypted basically looks like a random string of letters and numbers (so impossible to determine if what you've brute force decrypted is correct or not) you can rest assured nobody will be cracking your forms authentication cookie any time soon.
More info about Rijndael and its possible attacks here:
http://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Known_attacks