neraliu's blog internet profession in between hongkong/china and silicon valley (no longer, but the world!)

preventing the replay attack in the protocols

when you are designing a protocol over an insecure channel, some security features, like signature etc, would add to make it difficult for people to attack, however, when it is over an insecure channel, unauthorized parties can still sniff through the network and resue the request as will. this is known as the replay attack, as long as your secret  (may be password, algorithms etc.) is still unknown to the unauthorized parties, your content is still safe, however, if the request is somehow part of the protocol, you are still put yourself at risk.

in order to prevent the "replay attack", the easiest way is to use the "one-time" token in the protocols, for every request, the "one time" token is examined and the server end makes sure that the tokens do not recieved before, however, if you are going to design the internet application, the cost is hugh as the server is requires to save all the tokens to check. in order to leverage this situation, timestamp can be introduced to expire the token with the trade off of exposing to the replay attack within a period of time, depending on how frequent the tokens being expired.

disclaimer: this is not the comprehensive design of the secure protocol, it is simply a blog article in describing security topic.