I've just started working with elliptic curves and ECSDA in particular, so my understanding of the underlying math isn't great. The thing I'm currently stuck on is trying to understand why replay attacks don't work on ECSDA.
For this scenario, the public key, $Q = x \centerdot G$, where $x$ is the private key and $G$ is the generator of size $n$. Additionally, $H(m)$ is the hash of message $m$ and $k$ is a random number in $[1,n-1]$. The signature $(r,s)$ would then be defined as
$\begin{eqnarray*} r &=& (kG)_x \mod n\\ s &=& k^{-1}(H(m) + rx) \mod \ n \end{eqnarray*}$
Now, in this hypothetical attack, the attacker sees $(r,s)$ along with message $m_1$ and wants to send message $m_2$ on the next transmission via replay attack. If my math is correct, and it most assuredly isn't, he could achieve this by keeping the original $r$ and deriving the following:
($mod\ n$ omitted for tidiness)
$\begin{eqnarray} s_1 &=& k^{-1}(H(m_1) + rx)\\ &=& k^{-1}(H(m_1)) + xk^{-1}(kG)_x\\ &=& k^{-1}(H(m_1)) + (xG)_x\\ &=& k^{-1}(H(m_1)) + Q_x\\ k^{-1}(H(m_1)) &=& s_1 - Q_x\\ ...\\ s_2 &=& k^{-1}(H(m_2)) + Q_x\\ s_2 &=& (k^{-1}H(m_2))(H(m_1)H(m_1)^{-1}) + Q_x\\ s_2 &=& (k^{-1}H(m_1))(H(m_2)H(m_1)^{-1}) + Q_x\\ s_2 &=& (s_1 - Q_x)(H(m_2)H(m_1)^{-1}) + Q_x \end{eqnarray}$
$(r, s2)$ is now a valid signature for $m_2$. But that's way too easy to be realistic, so where's the error? The only thing I can think of is if $xk^{-1}(kG)_x \neq (xG)_x$, but it seems like it would need to for the authentication steps to cancel correctly.
If this were a valid attack, then the receiver would need to counter it by logging $r$ to ensure that it's never reused, and I've never heard anyone suggesting doing that.