ASPkey machinekey, validationkey and decryptionkey - key length

Question

What are the default key lengths that are generated when exiting the default ValidationKey and DecryptionKey? For instance:

<machineKey decryptionKey="AutoGenerate,IsolateApps" validationKey="AutoGenerate,IsolateApps" ... /> 

I could not find the documentation anywhere on MSDN. I would like to create a static machine key and save it according to the default values.

Answer 1

This MSDN page talks about the machineKey web.config element:

"For SHA1, set validationKey to 64 bytes (128 hexadecimal characters).
For AES, set decryptionKey to 32 bytes (64 hexadecimal characters).
For 3DES, set decryptionKey to 24 bytes (48 hexadecimal characters).

Another MSDN page contains additional information:

"validationKey indicates a manually assigned verification key. This value must be set manually to ensure consistent configuration of the web server network (web farm). The key must be at least 40 characters (20 bytes) and maximum 128 characters (64 bytes). If the keys shorter than the maximum length, they should be created in a truly random way, for example, using RNGCryptoServiceProvider. The recommended key length is 128 hexadecimal characters. If you add the IsolateApps modifier to the value validationKey, ASP.NET generates a unique encrypted key for Each application using each application with an application identifier. "

"decryptionKey indicates a manually assigned key. This value must be manually set to hexadecimal characters to ensure consistent configuration on the Internet farm. The key must be 16 characters long when using DES encryption and 48 characters long when using Triple DES encryption. If the keys are shorter than the maximum length they need to be created truly random means, for example, using RNGCryptoServiceProvider. ASP.NET can only use Triple DES on computers that have 128-bit encryption. If you add the IsolateApps modifier to the decryptionKey value, ASP.NET generates a unique encrypted key for each application that uses each application application Identifier. "

Answer 2

I used this site: http://aspnetresources.com/tools/keycreator.aspx many times to generate a machine key. I know this does not answer your question about default lengths, but at least it will give you a valid key :)

Answer 3

Refer to the following link:

http://msdn.microsoft.com/en-us/library/ms998288.aspx#paght000007_webfarmdeploymentconsiderations