Senior LevelAuthentication & Authorization
How do you design a High-Throughput Cryptographic Nonce Verification Engine to prevent replay attacks?
❓ Interview Prompt: Explain cryptographic nonces, replay attacks, sliding window timestamps, Redis Bloom Filters, and TTL memory optimization.
In API request signing and OAuth protocols, an attacker can capture a valid signed HTTP request and re-transmit it ("Replay Attack"). Preventing replay attacks requires Cryptographic Nonce Verification.
High-Throughput Nonce Engine Architecture:
1
Timestamp Sliding Window: Reject any request with a timestamp older than 5 minutes ($T_{\text{now}} - T_{\text{req}} > 300s$). Limits the nonce memory retention window to 5 minutes!
2
Redis Sliding Window Store / Bloom Filter: Store used nonces ('nonce:<uuid>') in Redis with a 5-minute TTL.
3
Lookup & Verification:
•
If 'nonce:<uuid>' exists in Redis $\rightarrow$ Reject request instantly as a Replay Attack!
•
If not found $\rightarrow$ Set key in Redis with 'EX 300' and process request.
4
Scale: For 100,000 req/sec, use Redis Counting Bloom Filters to achieve sub-millisecond memory lookups!
Code Implementation Example
typescript
async function verifyNonceAndTimestamp(nonce: string, timestampSeconds: number): Promise<void> {
const now = Math.floor(Date.now() / 1000);
// 1. Verify 5-minute timestamp sliding window
if (Math.abs(now - timestampSeconds) > 300) {
throw new Error('Replay Error: Request timestamp outside 5-minute window!');
}
// 2. Atomic SETNX in Redis to verify & record nonce
const nonceKey = "nonce:" + nonce;
const wasSet = await redis.set(nonceKey, "1", 'EX', 300, 'NX');
if (!wasSet) {
throw new Error('Replay Error: Nonce already used!');
}
}💡Atomic Redis SETNX nonce verification with 5-minute sliding window expiration.
🎯 Interview Key Takeaway
Prevent replay attacks using a 5-minute timestamp sliding window combined with atomic Redis SETNX nonce retention.
#Nonce Engine#Replay Attack#Redis#API Security#Senior
Back to all Authentication & Authorization Questions→