Generate Cryptographically Random Keys

To generate cryptographically random keys:

• Use the RNGCryptoServiceProvider class to generate a cryptographically strong random number.
• Choose an appropriate key size. The recommended key lengths are as follows:
  • For SHA1, set the validationKey to 64 bytes (128 hexadecimal characters).
  • For AES, set the decryptionKey to 32 bytes (64 hexadecimal characters).
  • For 3DES, set the decryptionKey to 24 bytes (48 hexadecimal characters).

The following code shows how to generate random key values. Compile the code to create a console application, and then pass the required key size as a command line argument expressed as the desired number of hexadecimal characters. Each byte is represented by two hexadecimal characters; therefore, to request a 32-byte key, pass 64 as a command line argument. If you do not specify an argument, the code returns a 128 hexadecimal character (64-byte) key.

C# Example

using System;
using System.Text;
using System.Security;
using System.Security.Cryptography;

class App {
  static void Main(string[] argv) {
    int len = 128;
    if (argv.Length > 0)
      len = int.Parse(argv[0]);
    byte[] buff = new byte[len/2];
    RNGCryptoServiceProvider rng = new 
                            RNGCryptoServiceProvider();
    rng.GetBytes(buff);
    StringBuilder sb = new StringBuilder(len);
    for (int i=0; i<buff.Length; i++)
      sb.Append(string.Format("{0:X2}", buff[i]));
    Console.WriteLine(sb);
  }
}

Visual Basic Example

Imports System
Imports System.Text
Imports System.Security
Imports System.Security.Cryptography

Module App
    Sub Main(ByVal argv() As String)
        Dim len As Integer = 128
        If argv.Length > 0 Then
            len = Integer.Parse(argv(0))
        End If
        Dim buff(len / 2) As Byte
        Dim rng As New RNGCryptoServiceProvider()
        rng.GetBytes(buff)
        Dim sb As New StringBuilder(len)
        Dim i As Integer
        For i = 0 To buff.Length - 1
            sb.Append(String.Format("{0:X2}", buff(i)))
        Next i
        Console.WriteLine(sb)
        Console.ReadLine()

    End Sub 'Main
End Module

Run the application two times, and then copy and paste the resulting keys into the <machineKey> element—one time for validationKey and the other time for decryptionKey.

Sharing Authentication Tickets Across Applications

If you need a single logon to work across multiple applications located in separate virtual directories, you need to share a common authentication ticket. To configure a common authentication ticket, you must manually generate validationKey and decryptionKey values and ensure that each application shares these values.

If you want to share tickets across all applications on your server you can set these manual values on the <machineKey> element in the machine level Web.config file. To share tickets across specific applications, you can use a <machineKey> element with common validationKey anddecryptionKey values in the relevant application's Web.config files.