3

What are the relation (difference and similarities) between Replay attack, reflection attack and relay attack?
All of them together seems a mess to understand! Are they not MITM?

Improve this question

1 Answer 1

Reset to default
6

These three have little in common. Only the replay attack can be really considered MITM, and even then, the MITM is only part of the attack. If anything, in theory reflection attack is a special case of relay attack, where you only use one device, though in practice they are very different.

  • Replay attack is partially MITM. Lets say you send an encrypted and signed command "OPEN_DOOR_1" to open a door on your smart home. Replay attack would be to capture the command and just send it again to open the door again, without knowing what the command is (encrypted) or knowing how to sign it (it is already signed).
  • Reflection attack is using the target to authenticate its own challenge. For example, you have two devices that authenticate each other and you use shared secret and HMAC to do the authentication. The target sends you a nonce that you are supposed to HMAC. You open a new connection with the target, request that it authenticates itself and send the nonce you received previously. You receive the HMACed response and send it back to the target pretending you HMACed it even though it was in fact the target.
  • Relay attack is usually used with smart-cards and tokens. You basically go to the terminal, with one device and to the smart-card with another. You just send the messages between to over distance. A nice example is in cars with wireless ignition, people were able to just use signal booster to boost the signal from the keys inside a house to the car outside, using the owners keys to unlock the car without ever entering the house or touching the keys and without breaking any encryption. Just making the car think the keys are closer then they really are.
Improve this answer
7
  • Thanks. It would be so kind of you if you can extend the reflection attack thing in layman's terms or with analogy. Rest is clear. Thanks again.
    – Mohammad
    Apr 22, 2018 at 19:13
  • @mahmudKabir It is a lot harder to explain than the other two, but in essence, imagine I want to confirm to you that it is me, and you want to confirm to me that you are you. We can both sign something with the same signature (same key). So we both send each other something random, sign it and send the signed thing back (this is basic challenge response). However, I instead of signing it myself (I don't actually know how to sign, no key) contact you again and this time instead of sending something random, I send what you sent me. So you sign it for me and I use the signature that you provided.
    – Peter Harmann
    Apr 22, 2018 at 19:24
  • @mahmudKabir If you don't understand why we send each other something random, it is to prevent Replay Attack. Because it is random, there is almost no chance any of us signed it before.
    – Peter Harmann
    Apr 22, 2018 at 19:25
  • It is now clear. I think i got lost in jargons earlier. Thanks again.
    – Mohammad
    Apr 22, 2018 at 19:36
  • One last thing, what does it means "The target sends you a nonce that you are supposed to HMAC" ?
    – Mohammad
    Apr 22, 2018 at 19:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .