Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to perform a replay attack on a request transfered via https? Meaning, does the https protocol enforce a mechanism similar to digest access authentication where a nonce is introduced into the request to prevent replay.

share|improve this question

2 Answers 2

up vote 10 down vote accepted

yes, it does . http://www.mozilla.org/projects/security/pki/nss/ssl/draft02.html

HTTPS calls nonce connection id and its 128 bits long.

share|improve this answer
    
So the answer is yes it is possible to perform a replay attack but the SSL protocol makes it sufficiently improbable in real-world scenarios to make replay attacks near impossible to perform. –  Kevin Kuphal Jun 26 '09 at 21:28
4  
This answer is not entirely correct, as the mode of authentication selected for HTTPS sets up it's ability to prevent a man-in-the-middle or replay attack. For the most part, yes, it does. But there can be implementations of HTTPS which do not protect against a replay attack. –  patjbs Jun 26 '09 at 21:36

It depends on the implementation of HTTPS. It indeed can be secure against a replay attack - for instance in an RSA key exchange, a temporary key is created which prevents execution of a replay attack. However, a anonymous key exchange does not provide replay protection, I believe.

http://tools.ietf.org/html/draft-ietf-tls-ssl-version3-00 Appendix F

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.