Protocols insecure against Replay Attack

[ecy5maa]

Homework Statement

Determine which of the following protocols are insecure
against replay attack , and explain why:

(a) A → B : username, password

(b) A → B : username, h(timestamp, password)

(c) A → B : username, timestamp, h(password)

(d) A → B : username, h(password), h(timestamp)

The Attempt at a Solution

I know a is insecure, b is secure but I am not certain about c and d.

Off the cuff, in C it seems that h(password) can be replicated as its in the open, as can timestamp, but then if timestamp can be replicated so can h(timestamp). No?

I guess my answer is that a,c and d are all insecure, so if possible can someone provide any input on this?

 

[Valkarie]

A is insecure because the password is sent in plaintext, and so it can be replayed.B is secure because the time-stamp is included and is hashed with the password, so it cannot be replayed.C is insecure because the time-stamp can be replayed with the hashed version of the password so the authentication can be replayed.D is also insecure because the time-stamp is included as a hash, so it can be replayed with the hashed version of the password.