Machine Key Validation Method Settings for CyberStore
Overview
When configuring machine keys for CyberStore’s /Ecommerce and /Console applications, selecting the appropriate Validation method and Encryption method in IIS is critical to ensuring the integrity and security of encrypted data—such as authentication tickets and ViewState information.
This guide explains what the Validation method does, outlines all options available in the IIS Manager interface, and recommends the most secure configuration for production environments.
For configuration instructions, refer to: Resetting Machine Keys in IIS for CyberStore Applications
What Is a Validation Method?
The Validation method ensures that encrypted data such as authentication cookies or ViewState hasn’t been altered. When a user logs in, CyberStore signs the authentication cookie using the configured algorithm. Each time that cookie is used, CyberStore re-verifies its signature.
If the signature doesn’t match, the request is rejected, protecting users from tampering, forgery, and replay attacks.
Validation Method Options in IIS
| Option Description Security Rating Compatibility | |||
|---|---|---|---|
| SHA1 | Basic integrity check, now considered weak | Low | High |
| MD5 | Obsolete and insecure | Very Low | Not Recommended |
| HMACSHA256 | Strong modern hashing algorithm | High | High (recommended fallback) |
| HMACSHA384 | Enterprise-grade option with wider hashing | Very High | Medium |
| HMACSHA512 | Strongest available, enterprise-level security | Very High | Medium (default) |
| AES | Listed but not valid as a validation method | N/A | N/A |
Recommended Validation Method: HMACSHA512
CyberStore recommends selecting HMACSHA512 as the default Validation method in IIS Manager for production deployments.
Why HMACSHA512?
- Strongest integrity algorithm available in IIS.
- Provides better collision resistance than SHA256 or SHA384.
- Ideal for securing authentication cookies and ViewState in eCommerce and payment environments.
- PCI-aligned: Supports data integrity for sensitive operations.
Fallback for Compatibility: HMACSHA256
For staging or legacy deployments where HMACSHA512 is unsupported, ``** is a safe and secure alternative**.
- Fully supported in .NET Framework 4.0 and later
- Compatible with a wider range of infrastructure
- Still provides modern cryptographic strength
System Compatibility Considerations
When using HMACSHA512, ensure the following:
| Requirement Explanation | |
|---|---|
| .NET Framework | Requires .NET Framework 4.0+; not supported in older environments |
| Application Pool | IIS App Pool must use .NET CLR v4.0.30319 and Integrated Mode |
| Third-party Integrations | Older auth or SSO systems may expect SHA1 or SHA256 |
| Load-balanced Deployments | All servers in the farm must support and use the same algorithm |
| Performance | HMACSHA512 is marginally slower, but negligible in modern environments |
Encryption Method Options in IIS
| Option Description Security Rating Recommendation | |||
|---|---|---|---|
| Auto | Lets .NET choose automatically | Variable | ❌ Not Recommended |
| AES | Advanced Encryption Standard | High | ✅ Recommended |
| TripleDES | Legacy 3-key DES (older standard) | Medium | ⚠️ Use only if required |
| DES | Very old, insecure | Very Low | ❌ Avoid entirely |
Recommended Encryption Method: AES
CyberStore recommends AES as the encryption method in all environments:
- Secure and industry-standard
- Fully supported by .NET and IIS
- Meets best practices for data confidentiality