replayangrep

Replayangrep, or replay attack, is a security vulnerability in which a valid data transmission is captured and resent to perform unauthorized actions. The attacker exploits the ability to reuse a previously sent message as if it were fresh, potentially gaining access, authorizing a transaction, or triggering an action again.

Mechanism: An attacker records a legitimate message during an earlier session and later transmits the exact data to the recipient. If the system does not verify the freshness of the message, the old transmission can be accepted as valid. Replay can target authentication handshakes, API requests, payment commands, or access-control systems such as RFID.

Contexts: Replayangrep can arise in network protocols, web services, mobile payments, and physical access systems. It is particularly relevant where authentication or critical actions can be bound to a single message or token that is reused.

Mitigations: Defenses include freshness guarantees such as nonces or timestamps, challenge-response protocols, and one-time-use tokens. Cryptographic signing of messages, session identifiers, and strict sequencing help ensure each message is unique. Transport-layer protections like TLS with anti-replay features, short token lifetimes, and transaction binding reduce risk. Additional measures include rate limiting, anomaly detection, and explicit replay-protection windows in protocol design.

History: Replay attacks have long been recognized in cryptography and security literature. They remain a concern as systems evolve and interoperate, prompting the integration of anti-replay mechanisms in modern protocols and standards.

See also: replay attack; nonce; timestamp; challenge-response; one-time password; anti-replay protection.