A valid Web Bot Auth (RFC 9421) signature reuses an in-window nonce — a captured-credential replay
net.web_bot_auth_nonce_replay · convicts
What it catches
RFC 9421 requires a Web Bot Auth signature's nonce to be UNIQUE within its validity window, so a real agent generates a fresh nonce per request and NEVER repeats one. The G25 forgery check (net.web_bot_auth_invalid) only catches a signature that FAILS verification or is past its expires window — it structurally MISSES a captured-and-replayed signature that is genuine AND still in-window: the cryptographic proof says 'a real signer made this', yet the SAME signed request is presented twice (credential capture/replay of a verified agent). The edge (internal/webbotauth ReplayStore) records the (keyid, nonce) of every VALID signature, evicting at the signature's own expiry, and fires network.web_bot_auth_nonce_replay when a nonce recurs for a keyid within its window. FP-SAFE BY CONSTRUCTION: nonces are single-use, so a legitimate signer never trips it; a blank nonce is untrackable and never convicts. On replay the verified allow-list is WITHHELD (scoring.verified_agent excludes this rule alongside web_bot_auth_invalid), so a replayed verified-agent request convicts instead of being allow-listed. CONVICTING (coherence): a fresh cryptographic proof reused is a replay, not a live signer. Extends the shipped G25 (the expiry arm); GROUNDED red⇄blue by the go-tls KS_WEBBOTAUTH=replay evader (one valid in-window signature presented twice under one session: the first verifies, the second fires web_bot_auth_nonce_replay) — see docs/research-radar.md G32. PRODUCTION wires the same real agent directories; the lab seeds the RFC 9421 test key.
Signals it reads
network.web_bot_auth_nonce_replay
How it fires
present
Evaders it caught 1
Bypassed by 10
Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.