Replay attack

A replay attack captures legitimate traffic, most usefully an authentication exchange, and retransmits it later. The attacker never needs to decrypt anything: if the system accepts the same bytes twice, yesterday’s valid logon works again today from the attacker’s machine. That makes replay one of the few attacks that succeeds against strong encryption used without freshness guarantees.

The defences all inject uniqueness into each exchange. Timestamps reject messages outside a short window; nonces (numbers used once) force each session to be new; sequence numbers expose reordered or repeated messages. Kerberos leans on timestamps, which is why the protocol tolerates only small clock skew between machines: an authenticator older than about five minutes is refused. This is also why pass-the-ticket works only within a ticket’s validity window rather than forever.

Exam relevance: two reliable question shapes. First, “captured and retransmitted credentials” names the attack: replay. Second, the Kerberos clock synchronisation requirement exists specifically to counter replay, and the exam asks that connection both forwards (“why do clocks matter?”) and backwards (“which attack do timestamps mitigate?”).