ASP/ASP.NET Session IDs

I know that TCP sequence numbers have been examined in detail to see
if TCP sessions can be hijacked by guessing sequence numbers.  Has any
similar research been done on ASP/ASP.NET Session id numbers?

The MSDN (at 
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnasp/html/aspwsm.asp)
tells us:

The following steps are taken when generating ASP session cookies:

    * Session ID values are 32-bit long integers.
    * Each time the Web server is restarted, a random Session ID
starting value is selected.
    * For each ASP session that is created, this Session ID value is
incremented.
    * The 32-bit Session ID is mixed with random data and encrypted to
generate a 16-character cookie string. Later, when a cookie is
received, the Session ID can be restored from the 16-character cookie
string (ASPSESSIONID).
    * The encryption key used is randomly selected each time the Web
server is restarted.

Because of item 3 (simple increment of Session IDs), it's obvious that
if you can determine a session ID, you stand a good chance of guessing
other Session IDs.  Does anyone know what is used to encrypt the
SessionID value, and if it's possible to make a guess as to what the
SessionID is based on the encrypted values received?


-- 
Steven DeFord
steve@singingtree.com
(925) 596-0426