In TLS, both client and server send nonces int heir hello messages. How the server identify whether the client hello is replayed or not? does the server maintain cach of previous nonce? for how long? can you clarify the mechanism to me as I do not find these details in the standard documentation.

  • $\begingroup$ If an attacker resends a previous legitimate client hello, or just a new client hello with the same nonce as a previous legitimate one, all it does is create a new session; it doesn't break anything that's supposed to be protected, so there's no need to prevent it. $\endgroup$ – dave_thompson_085 Mar 16 '17 at 5:22

Your confusion comes in who the client's nonce is protecting. The client's nonce protects the client from server replays. Similarly, the server's nonce protects the server from client replays. This makes it so that neither has to remember past nonces. As long as the client is implemented correctly and does not reuse a nonce, a server trying to replay a message will fail.

  • $\begingroup$ thanks. But I was thinking of Man-In-The-Middle that replays the client hello message that was generated by the original client. How the server recognize the replayed message? does it maintian a cache? $\endgroup$ – user6875880 Mar 15 '17 at 13:47
  • $\begingroup$ Man-in-the-middle or replay? Those are different attacks. In a MitM, the attacker intercepts the client hello, sends their own client hello to the server (not a replay). $\endgroup$ – mikeazo Mar 15 '17 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.