What happens when cbc+hmac get a replay attack?

Question

If it use AES-CBC and HMAC-SHA256 for message send online, and someone try to replay attack on this message. Can the attack be successful? what will be happen when attacking?

Answer 1

Rejecting replays is the duty of a higher level protocol. Simple authenticated encryption will accept any message with a valid MAC, even if you receive it several times. Decryption is a stateless process, but you need state to keep track of messages you already received.

For example you could associate an increasing counter with each message you send. The recipient then keeps track of the highest counter they have received so far and rejects any lower counters. You could send that counter in plaintext alongside the ciphertext, but make sure to include it in the data you MAC.

For other modes of encryption the IV/nonce can double as counter. This is the case for AES-GCM or XSalsa20Poly1305.