The client random is enough to prevent replay attack. The server signs the client random when sending the serverkeyexchange, so an attacker can't replay a session because client.random is different.

What is the purpose of server.random ?

  • I'm not a subject-matter expert and I certainly will not argue but "The client random is enough to prevent replay attack" needs a good reference in order to make such radical statements. – CriticalSYS Nov 1 '20 at 15:43
  • I said why I think it's true. I'm not an expert either, just a learner, but if the server signs the client random then replay attack won't be possible, since, in a new session, the replayer cannot re-use the old signature to send a valid pair. – confused_openssl_user Nov 1 '20 at 16:01
  • @confused_openssl_user you may be making the assumption that the client is behaving properly - each party contributes to the overall CS-entropy, so that no one party can unduly influence the spread of possible states that could then be used as an advantage for key discovery, or that both parties can benefit from the 'unpredictability' of the other (think along the lines of a newly booted client that has engaged in very little network activity, and has no carry-over from the previous session) – brynk Nov 1 '20 at 21:46
  • In the TLS versions that have ServerKeyExchange (1.0 through 1.2, not 1.3) the server does NOT sign client random, and even if it did that wouldn't prevent replay because replay uses the same client random. – dave_thompson_085 Nov 2 '20 at 0:33
  • @brynk So you mean that if for example a client had a flawed RNG that outputs the same nonce every time, an attacker could pretend to be the server and replay an old session (he has valid pairs (client.radom, signature(client.random)) ? – confused_openssl_user Nov 2 '20 at 18:27

Browse other questions tagged or ask your own question.