1

The ACME protocol defines the use of a replay nonce to prevent replay attacks.

I understand what replay attacks are and why it's important to prevent them in certain scenarios. But I can't think of a scenario where a replay attack would be a problem in the ACME protocol. Especially since the messages are signed and therefore can't be altered by a possible attacker.

So what are possible replay attack scenarios in the ACME protocol that are prevented by the replay nonce?

1 Answer 1

2
+50

Without the nonce, at least some account management actions would be vulnerable to replay attacks:

  • If the ACME client performs multiple Account Updates to change their contact e-mail address (e. g. because they no longer control the old addresses), then an attacker could replay any of the requests to change the address back to an old value. The impact depends on what exactly the e-mail address will be used for.
  • A previous Key Rollover could be reverted. However, since the request payload contains both the old key and the new key, an attack would require very specific circumstances: If the client has changed their key from k_1 to k_2 and then back to k_1, an attacker could reinstall k_2 by replaying the Key Rollover from k_1 to k_2.

Replay attacks against the core of ACME -- issuing certificates -- are not as obvious. What an attacker could do is flood the ACME server with replayed Order requests (to request a certificate) or Pre-Authorization requests (to request a challenge). Without a nonce, the server wouldn't be able to tell them apart from legitimate requests and would probably enforce a limit at some point. Then the actual account owner wouldn't be able to get new certificates.

However, an attacker cannot even acknowledge an identifier validation challenge, because each challenge has a unique URL which is also included in the request, effectively acting like a nonce itself. Replaying old requests for different URLs doesn't help. The server would have to reuse challenge URLs, and that's most definitely not what the RFC means.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .