About Security of machinekey

Question

We have a scenario using asp.net Forms Authentication in a web farm and need to setup identical <machinekey /> sections on each servers .config file.

Is it better to store the <machinekey /> section in machine.config rather then web.config? what's the advantages and disadvantages of each approach concerning security?

<machineKey validationKey="[keyhere]"
    decryptionKey="[keyhere]" validation="SHA1" />

If its not secure enough, is there any way to encrypt <machinekey /> section like we encrypt our connectionsstring (with DPAPI)? (http://msdn.microsoft.com/en-us/library/ms998280.aspx)

Best Regards Magnus

Answer 1

I would have it in the web.config to make it obvious that you are doing this. It also gives you the added capability of having different keys for different applications if you wanted for increased security between applications (Not that you may want to but it is an option if left in the web.config).

I don't think you are any less/more secure either way. If your server is compromised enough for the web.config to be stolen then likely the same is true of the machine.config.

I haven't done it but I think you can use DPAPI to encrypt the machineKey section. Not 100% on that though...

http://msdn.microsoft.com/en-us/library/ms998280.aspx#paght000005_step1