The production website must utilize SHA1 encryption for Machine Key.

SV-33314r4_rule The production website must utilize SHA1 encryption for Machine Key.

Vulnerability discussion

The Machine Key element of the ASP.NET web.config specifies the algorithm and keys thatASP.NET will use for encryption. The Machine Key feature can be managed to specify hashing and encryption settings for application services such as view state, forms authentication, membership and roles, and anonymous identification. Ensuring a strong encryption method can mitigate the risk of data tampering in crucial functional areas such as forms authentication cookies or view state.

Check content

1. Open the "IIS Manager". 2. Click the site name under review. 3. Double-click the "Machine Key" in the website "Home Pane". 4. Ensure "SHA1" is selected for the "Validation method". If not, this is a finding.

Fix text

1. Open the "IIS Manager". 2. Click the site name under review. 3. Double-click the "Machine Key" in the website "Home Pane". 4. Set the "Validation method" to "SHA1".

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.