Replay Protection & Cache

Phantom Grid SPA V2 implements robust defenses against Replay Attacks.

The Replay Cache

The Verifier module (verifier.go) maintains a high-performance, thread-safe cache of all successfully authenticated SPA packets.

1. Hashing: Upon receiving a valid SPA packet, its cryptographic payload is hashed using SHA-256.
2. Storage: The hash is stored in a concurrent sync.Map along with a timestamp.
3. Verification: When a new packet arrives, its hash is checked against the cache.
4. Expiration: Hashes are automatically purged from the cache after 5 minutes (matching the maximum TOTP skew window).

This ensures that even if an attacker sniffs a valid SPA UDP packet, sending it again will result in an immediate rejection.