Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Assume Alice and Bob communicate over an insecure channel using one-time perfectly-secret encryption together with one-time secure message authentication code. Say Eve has the ability to eavesdrop and to inject messages into this insecure channel, but not to block or delay messages (i.e. Eve can mostly only replay authenticated encrypted messages).

Of course we can design scenario damaging to Alice and/or Bob. How can they protect themselves against such replay attacks?

share|improve this question
    
For a full protocol that works well in this scenario, look at CurveCP. It's design goals explicitly take your scenario into account. –  CodesInChaos Oct 8 '12 at 19:44
    
@CodesInChaos Are you referring to CurveCP's use of nonces, aka number used once? I only added this comment because the current highest voted answer gives a similar answer. –  HeatfanJohn Oct 9 '12 at 2:41
    
@HeatfanJohn Both the use of nonces and that no forged packet can disrupt the connection. –  CodesInChaos Oct 9 '12 at 6:21
add comment

1 Answer 1

The archetypal safeguard against that threat is including an originator ID and a sequential number in each message (within the authenticated payload), and making the receiver ignore any message from him/herself, or with a number no higher than the highest in any message from that source so far. The sequence number can be replaced by time.

share|improve this answer
    
Assuming, of course, both parties have a way of accurately measuring the time and compensating for geographical differences, daylight savings, leap-seconds, etc. –  Polynomial Nov 6 '12 at 13:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.