是否可以对机器密钥加密进行纯文本攻击？

Question

I protect some strings with the following function:

public static string ProtectString(string input)
{
    System.Text.ASCIIEncoding enc = new System.Text.ASCIIEncoding();
    return enc.GetString(MachineKey.Protect(enc.GetBytes(input), null));
}

If i now encrypt a string, the attacker may now (ie an username), is he able to extract the machine key with the encrypted and decrypted values?

Answer 1

I did some research and found out, that the used algorithm is one of those: DES, 3DES or AES . And that algorithms are very resistant to plain-text attacks.

Based on Chris' comment, DES is very weak, so choose AES if possible.

But that's not a reason, to gift plain text values to your attacker :)

Answer 2

If you give a hacker the cipher text and the plain text, that is all he needs to brute force the crypto key. That and a farm of high performance computers.

Really there is rarely a reason to send the clear text and plain text at the same time. Just don't do it. If you want to make the clear text tamper-resistant, pass the cleartext along with an HMAC instead.