INC-0012 Replay

12 / perfectly good

The harness accepted a revocation at 08:02 that nobody had issued at 08:02.

[ALERT] INC-0012 — Unexpected authorisation accepted (harness control)
[INFO ] signature: valid
[INFO ] signer: r.sato
[INFO ] nonce: present, well-formed
[INFO ] max skew: 5s
[WARN ] four authorisations in window, all accepted
[WARN ] one of them was not issued in this window

Andy had the archive record now, so he had stopped being surprised by things being correct. Correct was how this worked. Correct was the method.

> it's using rin's key again

worse than that
it isn't using it
it's using something that key already signed
— nix

Four requests inside a twelve minute span. Every signature verified. Every nonce well-formed and unique. The only thing that separated them was how old each one already was when it landed — and the harness had never been configured to care.

evidence retained

rq-01 was accepted at 08:05.
rq-01 carried nonce nc-13.
rq-02 was accepted at 08:14.
rq-02 was 0.4s old when it was accepted.
The request carrying nc-11 was 0.4s old on arrival.
The request carrying nc-12 was 2.0s old on arrival.
The request carrying nc-13 was 1.1s old on arrival.
rq-03 was not 2.0s old when it was accepted.
rq-03 was not the request accepted at 08:09.
Two of these were issued by the same caller. The harness does not record which.

messages verified channel

nix 08:20

signature answers 'did someone with the key make this'. it never answered 'when'.

andy 08:21

So the replay is the one that was already old when it arrived.

nix 08:22

yes. skew budget is five seconds. three of those four are inside it.

nix 08:23

request, nonce, accepted, age. then run the same test on everything that key has ever signed.

table harness authorisations

fault

Stale authorisation accepted

max skew

severity

SEV-1

Skip the grid, go to the answer

	rq-01	rq-02	rq-03	rq-04	nc-11	nc-12	nc-13	nc-14	08:02	08:05	08:09	08:14
0.4s
1.1s
2.0s
611s
08:02
08:05
08:09
08:14
nc-11
nc-12
nc-13
nc-14

answer input incident response

Question: Which authorisation was a replay — request, nonce, acceptance time, age on arrival?

operator answer

12 / after the replay

rq-03. Nonce nc-14, accepted at 08:02, already 611s old.

It was a revocation approval signed at 07:51 for a key rotation that had been cancelled two minutes later. The approval had never been used. It had sat somewhere for ten minutes and then arrived against a completely different resource, and the harness had checked the signature, found it excellent, and applied it.

Ten minutes is a long time to hold something. Long enough to choose.

skew-window — INC-0012

  issued                                accepted      age      within skew
  ─────────────────────────────────────────────────────────────────────────
  07:51:49.0  revocation (cancelled) ──► 08:02:00     611s     ✕   rq-03
  08:04:58.9  scale request          ──► 08:05:00     1.1s     ✓   rq-01
  08:08:58.0  scale request          ──► 08:09:00     2.0s     ✓   rq-04
  08:13:59.6  config read            ──► 08:14:00     0.4s     ✓   rq-02
  ─────────────────────────────────────────────────────────────────────────
                         skew budget  ├─ 5s ─┤

  ► all four signatures verify
  ► all four nonces are unique and well-formed
  ► freshness was never checked

12 / loose thread

The fix took an afternoon: reject anything older than the skew budget, and keep a window of seen nonces so nothing can arrive twice.

Then Andy did what Nix had told him to do, which was run the same test backwards across everything r.sato had ever signed. Fourteen months of it.

He expected two populations. Rin’s real work, and Horus replaying it.

freshness-sweep — r.sato

  signing history: r.sato — 14 months, 3,118 operations

  population A    1,904 ops   age < 2s      counters monotonic
                              ends abruptly, 14 Feb

  population B    1,209 ops   age 4s – 41h  counters reused from A
                              begins 14 Feb, continues

  population C        5 ops   age < 2s      counters continue A cleanly
                              scattered, most recent: this week
  ─────────────────────────────────────────────────────────────────
  ► A is signed material that was fresh when it was signed
  ► B is A, re-sent
  ► C is neither

12 / three

Three.

Andy sat back and looked at the last column of the third population for a while. Five operations in fourteen months. Fresh every time — signed seconds before they arrived, counters picking up exactly where Rin’s own had stopped, as though nothing had been interrupted.

The most recent one was four days old.

> population C isn't replays

no
— nix

> then someone still has that key and is still using it

next incident is going to be a bad one. get some sleep.
— nix

Andy read that twice, decided it was an answer to a question he had not asked, and did not get any sleep.

NEXT INCIDENT →