Replay attack

As explained in Real-World Cryptography

A replay attack resends a previously valid message and its authentication data so that they may be accepted again as current.

A replay attack resends a previously valid message and authentication tag so the recipient may accept an old action as current. A MAC proves authenticity, but not freshness, unless the protocol adds replay protection. section 3.3.3 section 3.2

A practical defense tracks message order or freshness:

• Add an incrementing counter to the MAC input; reject tags computed with an unexpected counter. section 3.3.3
• Use fixed-length counters, commonly 64 bits; rotate the shared key before the counter wraps, then reset it. section 3.3.3
• Treat variable-length counters cautiously because ambiguous encodings can enable authentication-tag forgeries. section 3.3.3

Authenticated transport

TLS 1.3 increments the authenticated-encryption nonce for each message. Replayed or reordered records use the wrong nonce, causing decryption to fail and the connection to close. Its 0-RTT early data is different: a passive attacker can replay it, so applications should use it only for safely replayable operations. section 9.2.2

Figure 3.5 Two users sharing two keys, k1 and k2, exchange messages along with authentication tags. These tags are computed from k1 or k2, depending on the direction of the messages. A malicious observer replays one of the messages to the user.

Trace an observer capturing an authenticated message and sending it again, then compare it with the counter-protected exchange. section 3.3.3

How Real-World Cryptography covers it

How deep it goes

Explains the threat, counter defense, key rotation, nonce sequencing, and variable-length ambiguity without implementation detail.

Examples

Uses Alice-and-Bob message exchange, Rust HMAC code, TLS records, and replayable 0-RTT application data.

What it assumes

Assumes familiarity with authentication tags and shared keys while explaining replay risk from those ingredients.

What you can do after

Diagnose replay exposure, add counter or nonce sequencing, and restrict 0-RTT to safely replayable operations.

How it connects

Connects message authentication codes, HMAC, authenticated encryption, TLS 1.3, nonces, counters, and 0-RTT.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersA replay attack is an attack in which a valid previously captured message or credential is retransmitted to obtain an unauthorized effect.
• 

  liveBookmanning.com
  The Design of Web APIs, Second EditionRequest replay is the repeated submission of a previously captured API request, potentially causing an operation to occur more than once.

Compare how 3 books explain replay attack →

Related concepts

• timestampaddressed by · A timestamp is a value representing a specific point in time, typically associated with an event, observation, or data item.
• challenge-response authenticationaddressed by · Challenge-response authentication is an authentication method in which a claimant demonstrates knowledge of a secret or possession of a credential by producing a valid response to a verifier's challenge.
• nonceaddressed by · A nonce is a value intended for one-time use within a specified cryptographic, authentication, or authorization context.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.