I am considering a system where a small device accepts messages/commands from another device over a wireless channel. I am worried about replay attacks. The messages will be encrypted. What are well-vetted schemes for protection against these attacks? I am not too keen on timestamps (as described in this Q&A) as I don't really want to have to keep clocks synchronised. I am currently thinking of using HMAC but want to be sure that I'm doing the right thing.
$\begingroup$
$\endgroup$
4
-
$\begingroup$ Is the wireless channel bidirectional? Do you have read/write memory protected against power loss in the small device? Memory protected from adversarial reading to some degree, for secret keys? In the other device? Does it matter if compromise of the confidentiality of keys in a small device allows to forge commands for others? $\endgroup$– fgrieu ♦Commented Aug 27, 2016 at 11:24
-
1$\begingroup$ will the classic Anti-Replay mitigation using sliding window protocol work for u ? en.wikipedia.org/wiki/Anti-replay $\endgroup$– sashankCommented Aug 27, 2016 at 13:01
-
$\begingroup$ @fgrieu: Yes, the channel is bi-directional and can also be encrypted. Yes, the memory is protected against power loss and has a degree of protection. I will be doing an ECDH for creating an ephemeral encryption/decryption key so will also have the notion of a session. $\endgroup$– errCommented Aug 27, 2016 at 13:14
-
$\begingroup$ @sashank thanks for the link. I thought of that and was hoping to use something that couldn't be easily guessed by an attacker. $\endgroup$– errCommented Aug 27, 2016 at 13:15
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
0
An old but excellent paper on this topic is Tuomas Aura's Strategies against Replay Attacks.
The simplest version of the "Hashed Full Information" method would be to include the MAC of the previous message in the next message (you may also be able to use this as the nonce). Then store the most recent MAC along with the session key and check new messages against that. This would force serialization of messages within each session. (Assuming that is what you were thinking of when writing "use HMAC".)
