Comment by simonw
12 hours ago
It should be if each message includes an incrementing counter and the clients keep track of which counters they have already seen.
12 hours ago
It should be if each message includes an incrementing counter and the clients keep track of which counters they have already seen.
You don't actually need the signing if you have the counters (if your ~only goal is to prevent replay attacks of that form).
Yes, exactly, signing the transmission is not enough.
You've just added a nontrivial amount of memory usage as well that will look a lot like a memory leak as it grows.
you use a cyclic sequence counter and a rolling replay protection window to avoid overflow with the signature. use an epoch counter for rollovers after as long a period as you can stuff into the value.
you'll end up being protected from overflow for a practically-forever length of time with fairly few bits as long as the game isn't polling extremely fast.
it's not foolproof, and it's to thwart a kid, so ehh i'm not that into it.