IIS machine keys are cryptographic secrets used by ASP.NET and IIS to protect application data. They help sign and sometimes encrypt items such as view state, forms authentication tickets, and other trusted web tokens, so the server can tell whether a request or stored value was created by a legitimate application instance.
They matter because exposure of these keys can turn a simple server compromise into durable access. If an attacker steals machine-key material, they may be able to forge trusted requests, tamper with application state, or create authentication artifacts that survive a patch or web-shell removal. Defenders treat key rotation as containment: regenerate the keys, restart IIS, and review configuration files and logs for signs that secrets were accessed. In practice, machine keys are part of the trust boundary, not just routine configuration.