I got this error when implementing a custom membership provider for which I grabbed the code from this MSDN article.
When I tried to login through ASP.Net's Login control I got the following error:
"Hashed or Encrypted passwords are not supported with auto-generated keys"
Microsoft has said that they intentionally disable the use of auto-generated keys when encrypting passwords. This is to prevent passwords being irretrievable after moving membership databases to different machines:
"Back in the alpha we kept running across developers that worked a little bit on one machine and then picked up their MDB and copied it to another machine. At which point—surprise!—none of the passwords could be decrypted any more. So we decided to disallow autogenerated keys when using encrypted passwords. The reality is that autogenerated keys are really fragile. It's just way too easy to get yourself in a situation where these keys change. And once that happens, you are left with a useless membership database."
So, we need to generate the keys ourselves. To do this we use the RNGCryptoServiceProvider class. Below is a simple console application that will generate a key of a specified length (default is 128):
using System;
using System.Text;
using System.Security;
using System.Security.Cryptography;
class App
{
static void Main(string[] argv)
{
int len = 128;
if (argv.Length > 0)
len = int.Parse(argv[0]);
byte[] buff = new byte[len/2];
RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
rng.GetBytes(buff);
StringBuilder sb = new StringBuilder(len);
for (int i=0; i<buff.Length; i++)
sb.Append(string.Format("{0:X2}", buff[i]));
Console.WriteLine(sb);
}
}
Because I am using the SHA1 algorithm Microsoft advises (http://msdn.microsoft.com/en-us/library/ms998288.aspx) to use a key of 128 characters. SHA1 is asymmetric so I haven't specified a decryptionKey value and I've set decryption attribute to "Auto". Now my web.config looks something like this:
<machineKey
validationKey="B1D60ECC31789D1266F7452C81EB1DBE8C05F8A0C3826175EE35B2F1981DC94AE3EC36476B603715CB1DA0EA0F06503C90F338E38817DE5D9EAD9B41F61ADEAD"
validation="SHA1"
decryption="Auto" />