Replay Attack

The attack begins with passive eavesdropping, where the adversary uses a Software-Defined Radio (SDR) to capture raw IQ samples of a legitimate transmission without alerting the target. Unlike active jamming, this phase is undetectable because the attacker only listens. The captured waveform is stored with high fidelity, preserving all protocol headers, payload data, and physical-layer characteristics. This phase exploits the inherent broadcast nature of the wireless medium, requiring no physical connection to the network.

The core mechanism is the delayed retransmission of the captured signal. The attacker does not need to decrypt or understand the message content; they simply rebroadcast the identical waveform at a later time. This temporal gap is the defining characteristic that distinguishes replay attacks from real-time man-in-the-middle attacks. The delay can range from milliseconds to days, depending on the attacker's objective, such as re-authenticating a session or re-issuing a command to an actuator.

Replay attacks succeed because the retransmitted signal is cryptographically valid. The payload contains correct authentication tokens, session keys, or encrypted commands generated by the legitimate device. Standard message integrity checks and encryption do not prevent the attack because the data itself has not been altered. The vulnerability lies in the protocol's failure to verify the freshness of the message, making temporal context the missing security dimension.

Physical Layer Authentication defeats replay attacks by analyzing the hardware-specific impairments of the transmitter. Even if an attacker perfectly retransmits the digital payload, their own transmitter's unique RF DNA—including power amplifier non-linearity, I/Q imbalance, and oscillator phase noise—is embedded in the retransmitted waveform. A trained deep learning classifier compares the fingerprint of the incoming signal against a stored profile of the legitimate device, instantly flagging the mismatch.

Distance bounding protocols establish an upper bound on the physical distance between the verifier and the prover based on the speed-of-light signal propagation delay. The verifier issues a rapid challenge-response exchange where the prover must reply within a nanosecond-precision window. A replay attacker, located at a different distance or incurring processing delay, cannot meet the strict timing constraint. This renders the retransmitted signal invalid regardless of its cryptographic or physical-layer fidelity.

At the protocol layer, cryptographic nonces (numbers used once) and timestamps prevent replay by binding each message to a unique, time-sensitive value. The legitimate receiver tracks recently used nonces and rejects any message containing a duplicate. In challenge-response authentication, the verifier sends a random nonce as a challenge, and the prover must sign or encrypt it in the response. A captured response cannot be replayed because the next challenge will be different.

A cryptographic countermeasure that defeats replay attacks by measuring the round-trip time (RTT) of a signal. The verifier issues a rapid challenge and measures the precise nanosecond-scale delay of the response. Since an attacker cannot make a signal travel faster than the speed of light, a relayed or replayed signal will exceed the expected time-of-flight threshold, proving the transmitter is not physically proximate. This is a critical defense in passive keyless entry systems.

A foundational cryptographic defense where the verifier sends a randomly generated, single-use number (nonce) to the claimant. The legitimate device must encrypt or sign this nonce with a shared secret key and return it. A captured transmission from a previous session is invalid because it contains an old nonce. This ensures liveness and prevents simple record-and-replay, though it does not defend against sophisticated physical-layer relay attacks.

This defense combines physical layer authentication with replay detection. A deep learning model, often a Siamese Neural Network, continuously verifies that the unique hardware impairments (e.g., I/Q imbalance, oscillator phase noise) of the transmitting device match the known profile. A replayed signal, even if cryptographically valid, will fail this check if it originates from a different radio or a high-fidelity arbitrary waveform generator, as the subtle physical signature will not match.

A simple but effective defense for systems with synchronized clocks. Each transmitted packet includes a precise, authenticated timestamp from a trusted source like GPS. The receiver validates that the timestamp is within an acceptable drift window of its own current time. A replayed packet is immediately rejected because its timestamp is stale, preventing an attacker from injecting old, valid commands into a time-sensitive system like a drone control link.

Commonly used in garage doors and key fobs, a rolling code system uses a pseudo-random number generator synchronized between the transmitter and receiver. After each successful authentication, both sides advance to the next code in the sequence. A replay attack fails because the captured code has already been used and the receiver will only accept the next, unpredictable code in the sequence, providing robust protection against simple capture-and-retransmit attacks.