DataTerminology.comNEW
An attack that maliciously repeats or delays valid messages to fraudulently re-execute operations or bypass authentication.
DESCRIPTION
Replay attacks occur when an adversary captures a legitimate message and retransmits it to repeat or delay actions. Without freshness checks, systems can accept stale messages as valid, enabling fraud or privilege abuse. Common mitigations include nonces, timestamps, sequence numbers, and challenge-response protocols. Modern standards require replay resistance for authentication and token use. Logging and rate limiting help detect anomalies indicative of replay attempts.
ALTERNATIVE DEFINITIONS
NIST CSRC Glossary
An attack in which a valid data transmission is maliciously or fraudulently repeated or delayed.
Concise emphasis on repetition or delay of valid transmissions.
Cloudflare Learning Center
A replay attack is when a malicious actor intercepts and retransmits a valid data transmission, often to gain unauthorized access or duplicate a transaction.
Adds practical goals like unauthorized access and duplicate transactions.
RELATED TERMS
Timestamps Sequence Number MAC TLS Kerberos OAuth 2.0 JWT Idempotency
COMPETING TERMS
Challenge-Response Authentication Nonce
KNOWLEDGE AREAS
Data Security Data Integration & Interoperability Software Engineering Cloud
TARGET AUDIENCE
Software Developer Security Architect Cybersecurity Engineer DevOps Engineer IT Auditor
EXTERNAL SOURCES
- Wikipedia - Replay attack
- NIST - Digital identity guidelines with replay resistance
- IETF - TLS 1.3 security properties including anti-replay
- IETF - Kerberos protocol with timestamp-based replay protection
TOP QUESTIONS
How does a Replay Attack work?
An attacker captures a valid message and resends it later to repeat actions or bypass freshness checks. Without nonces or timestamps, systems may accept it.
Category: Overview
What prevents Replay Attacks?
Nonces, sequence numbers, and timestamps combined with integrity protection (MAC/signature) ensure messages are fresh and unrepeatable.
Category: Best practices
Are signed messages safe from replay?
Not automatically. Signatures protect integrity, but freshness must be enforced with nonces, expirations, or one-time challenges.
Category: Misunderstanding
How does TLS 1.3 mitigate Replay Attacks?
It limits early data (0-RTT) replays and uses unique nonces and session keys; applications must still defend idempotency.
Category: Standards
What are common Replay Attack targets?
Payment APIs, authentication flows, and state-changing API calls that lack nonce or timestamp validation are frequent targets.
Category: Example
How do I detect Replay Attacks?
Monitor for duplicate nonces, repeated request IDs, or unusual retry patterns. Maintain short-lived caches of seen tokens.
Category: Observability
Do JWTs prevent Replay Attacks?
JWTs can be replayed if leaked. Use short expirations, jti claims, audience checks, and TLS to mitigate.
Category: Misunderstanding
What is challenge-response authentication?
A server issues a unique challenge (nonce) that the client must sign or MAC, proving freshness of the response.
Category: Definition
What design principle reduces replay impact?
Idempotency in APIs ensures repeated requests do not cause duplicate side effects, limiting damage from replayed messages.
Category: Design