security//replay attack

A replay attack is an attack in which valid data or messages, captured earlier, are sent again to a system that accepts them because they are genuine, only out of place or out of time; it works against anything that checks that a message is authentic without checking that it is fresh, from a signed blockchain transaction to the sensor values shown on a plant's screens. The attacker needs no key and no model of the system, only a recording.

A replay attack is an attack in which valid data or messages, captured earlier, are sent again to a system that accepts them because they are genuine, only out of place or out of time; it works against anything that checks that a message is authentic without checking that it is fresh, from a signed blockchain transaction to the sensor values shown on a plant's screens. The attacker needs no key and no model of the system, only a recording.

In blockchains the classic case is a transaction signed for one chain submitted again on another chain with the same chainId. Putting the chain ID in the signature (EIP-155, introduced for exactly this) makes different chains produce different signature hashes. Even with the same chainId, a nonce mismatch blocks the replay: if the target chain's account nonce is ahead, the old nonce is rejected. EIP-712 goes further and adds the verifyingContract address to the signed domain, which prevents cross-contract replay on the same chain.

In cyber-physical security the replayed data are measurements. An attacker records the sensor values of a plant running normally, then plays them back to the operators and to the monitoring system while driving the process elsewhere. Every residual stays perfect, because each replayed value was once true and consistent with all the others. Stuxnet did this to the operators of an enrichment plant's centrifuges while forcing them to damaging speeds.

Authenticity is not freshness.

A signature proves who produced a message; only a nonce, a counter or a trusted timestamp proves it was produced now, and only a signal the recording cannot contain proves that a stream of measurements reflects the present state of the plant.

The defences add freshness. Message protocols include a nonce or a monotonic counter in each signed message and reject any value already seen; timestamps work if the clocks are trusted and synchronized (time synchronization).

For measurements, freshness has to come from the plant itself: physical watermarking makes the actuation carry a secret the replayed recording cannot contain.