5 ms·
You make a good point. I wonder if the time frame between writing the encrypted data, and reading it back has anything to do with it. Because if it were possibl
by euroclydon 16y ago
You make a good point. I wonder if the time frame between writing the encrypted data, and reading it back has anything to do with it. Because if it were possible for the time frame to be long, then the application would be required to persist the signature for a while.
- Groxx 16y agoYou lost me a bit there... writing and reading it back, and persisting the signature? To try to cover the base I think I see: ASP.NET uses a single encryption key for all sessions, until you change the values in the web.config file (which I think requires a reboot).
- euroclydon 16y agoI was thinking that the signature needed to be kept on the server, away from the attacker, because they could simply re-sign the message, but now I realize that checking the signature first would prevent the routine from ever getting to the decrypt algorithm, and thus no information would be leaked, so the attack would fail.