Replay Attack

The attacker does not need to decrypt or modify the original message. The attack relies on eavesdropping on a legitimate communication channel to capture a valid, authenticated data stream. This passive nature makes it difficult to detect, as the attacker's initial action is simply listening, not transmitting. The captured data, which could be an encrypted token, a digital signature, or a raw RF waveform, is stored for later retransmission.

The core mechanism is the fraudulent delay and retransmission of the captured data. The attacker injects the valid message into the network at a later time, outside its intended temporal context. This exploits protocols that lack robust timestamp verification or single-use nonce mechanisms. The system processes the replayed message as a fresh, legitimate request, effectively authorizing the attacker based on a past credential.

The ultimate goal is to masquerade as an authenticated entity without possessing the original secret key or biometric trait. By replaying a successful authentication sequence, the attacker bypasses the cryptographic challenge entirely. The system trusts the data because it is mathematically valid, failing to distinguish between an original transmission and a perfect copy. This allows unauthorized command execution, data exfiltration, or session hijacking.

Replay attacks succeed by exploiting stateless or poorly designed authentication protocols. A protocol is vulnerable if it lacks:

• Cryptographic nonces: Single-use random numbers that prevent message reuse.
• Timestamps: Fine-grained time verification with strict acceptance windows.
• Session-specific keys: Keys derived uniquely for each communication session. Without these, a message valid at T=0 remains valid at T=+1 hour.

In wireless contexts, the attack extends to the physical waveform itself. An attacker uses a high-fidelity Software-Defined Radio (SDR) to sample and store the raw IQ (In-phase/Quadrature) signal of a legitimate transmitter. The stored waveform is then broadcast verbatim, replicating not just the data but the unique RF fingerprint of the authorized device. This challenges physical-layer authentication systems that rely on static, rather than challenge-response, fingerprint verification.

Attackers use software-defined radios (SDRs) to capture the rolling code signal from a victim's key fob while simultaneously jamming the car's receiver. The captured valid code is then replayed to unlock and start the vehicle. Modern Passive Keyless Entry and Start (PKES) systems are vulnerable to relay-replay attacks where the signal is amplified and forwarded in real-time, effectively extending the key fob's range from inside a house to the car in the driveway.

In critical infrastructure, an attacker captures a legitimate Modbus or DNP3 command that opens a valve or disables a safety interlock. The attacker replays this command during a different operational state, causing physical damage. The Stuxnet worm utilized a form of replay attack by recording normal sensor readings and replaying them to operators while the centrifuges were being destroyed, masking the attack in real-time.

A replay attack against biometric systems involves presenting a previously captured biometric sample to the sensor. This can be a high-resolution photograph for facial recognition, a gelatin finger cast for fingerprint scanners, or a voice recording for speaker verification systems. Without liveness detection mechanisms, the system cannot distinguish between a live presentation and a replayed artifact.

An attacker with a concealed NFC reader brushes against a victim in a crowd, capturing the EMV transaction data from a contactless card. While modern EMV protocols use dynamic cryptograms, poorly implemented terminals or legacy magnetic stripe data captured via replay can be used for card-present fraud. The captured data is replayed at a terminal that does not enforce chip authentication properly.

Historically, one of the most widespread replay attacks involved intercepting legitimate ECM (Entitlement Control Message) keys from a paid subscriber's smart card and replaying them to a network of pirate receivers. This card-sharing attack allowed thousands of unauthorized users to decrypt premium content using a single valid subscription's key stream, replayed over the internet in real-time.

Replay attacks are fundamentally defeated by physical layer authentication using RF fingerprinting. Even if an attacker perfectly captures and retransmits the digital payload, the analog hardware impairments—such as DAC non-linearity, I/Q imbalance, and oscillator phase noise—of the attacker's transmitter will differ from the legitimate device. The system detects the mismatch in the embedding space and rejects the replayed signal, providing security that is independent of cryptographic key compromise.