Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that masquerading is to impersonate a false identity and replaying is the same wherein unauthorized person uses the credentials of the authorized one to have the privileges.Then what is the difference between the two terms?

share|improve this question
up vote 8 down vote accepted

These two terms do not have meanings at the same level. Masquerading (or impersonation; the two terms are equivalent) is any attack wherein the attackers acts (emits data packets or the like) as if he was some other user or entity in the system. Replay attacks are attacks where the attacker simply sends a data element (e.g. a data packet) which was previously sent by some other user, in the hope of reproducing the effect.

Thus, a "replay attack" is often a specific kind of impersonation; or you can consider replay attacks to be a tool used to implement an impersonation attack.

share|improve this answer

To try to answer your question more directly, an impersonation attack may be a replay or may be some other type of attack. (For example a man in the middle could impersonate the client by getting the legitimate information rather than simply replaying a previously recorded session.)

Similarly, a replay attack may or may not have anything to do with impersonation. While many replay attacks may be based on trying to impersonate a previous request, if proper IVs aren't being used on cryptographic communications, a replay attack could be used to inject incorrect information in to a stream as well without actually impersonating the user. It would instead simply be hijacking a legitimate action.

So in short, you are correct that the two terms are often related since replay may be used to impersonate in certain situations, but those aren't the only uses of the two concepts.

share|improve this answer

In STRIDE(security threats) :

"Spoofing is attempting to gain access to a system by using a false identity. This can be accomplished using stolen user credentials or a false IP address".[1] Is referred to attacks on authentication.

So masquerading as someone with privileges would be a type of Spoofing in my opinion while reply attack refers to Tampering(affects Integrity).

"Tampering. Tampering is the unauthorized modification of data, for example as it flows over a network between two computers."[1]


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.