According to what I understand from the
ViewState method in
ASP.net, when the server generates the
MAC enabled, he will send it to the client with the
MAC computed from the
ViewState message in the end of the
Then, the client will postback this
ViewState with the
MAC. The server will check the
MAC that he has received with the
MAC he has stored when he first sent it. If It matches, so the integrity is conform.
However, I read this article : https://msdn.microsoft.com/en-us/magazine/ff797918.aspx
It explains that a secret key is also added to the message and the
MAC is computed from the message and the secret key
I don't see any reason about having a secret key. Can you then explain me why It is used?