I was reading the Wiki entry for Replay attacks. It mentions that timestamps can be used as a countermeasure against such attacks:
Timestamping is another way of preventing a replay attack. Synchronization should be achieved using a secure protocol. For example, Bob periodically broadcasts the time on his clock together with a MAC. When Alice wants to send Bob a message, she includes her best estimate of the time on his clock in her message, which is also authenticated. Bob only accepts messages for which the timestamp is within a reasonable tolerance. The advantage of this scheme is that Bob does not need to generate (pseudo-) random numbers, with the trade-off being that replay attacks, if they are performed quickly enough i.e. within that 'reasonable' limit, could succeed.
I am not an expert in this, in fact, I am very new to these concepts but that sounds extremely unsafe.
- In reality, how easy is it to get within the reasonable limit?
- What are the most commonly used countermeasures against this type of attack? Tokens?