AUTH: X509Token Authentication is vulnerable to replay attacks -------------------------------------------------------------- Key: JGRP-1487 URL: https://issues.jboss.org/browse/JGRP-1487 Project: JGroups Issue Type: Bug Security Level: Public(Everyone can see) Affects Versions: 3.0.9 Reporter: sreenivas chinimilli Assignee: Tristan Tarrant Fix For: 3.5 In the implementation of X509Token Authentication The auth_value is enrypted with the certificate within the keystore and during verification encrypted auth value is decrypted with the private key compared against the orignial auth value. This implementation is prone to replay attacks, that is any user with out having any knowledge of the auth value can join the group by replaying the enrypted auth value captured in earlier sessions.