1) A → B : username, timestamp, h(password)

2) A → B : username, h(password), h(timestamp)

Can above two formula prevent from suffering replay attack?

I think 1 is immune from replay attack but i am not sure about second one.

Can any one help me?

  • The best replay attack prevention for most systems is to use SSL. Then you can just send username and password. Commented Apr 13, 2016 at 16:07

1 Answer 1


None will protect against a replay attact.

In the first case, all the attacker has to do is adjust the timestamp.

In the second case, since H() is not supposed to be secret and since the timestamp is known, and attacker can also adjust the request by creating a valid H(timestamp). There is also the problem that you need to synchronize the client and server so that they both have the same timestamp value.

The best way to prevent replay attack is to use challenge-response (there are other ways to do that, depending on your needs).

  • great help, thank you so much! i understand first case now. For second case, i am not completely understand. Ins't the H() supposed to be irreversible? Can you elaborate more?like if an attacker knows the H(), how can the attacker change the request?@Stephane
    – Ricky
    Commented Apr 13, 2016 at 14:30
  • I've added some details to my answer
    – Stephane
    Commented Apr 13, 2016 at 15:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .