Nick Mathewson
--- a/spec/rend-spec/introduction-protocol.md
+++ b/spec/rend-spec/introduction-protocol.md
+so long as the opportunity for replay attacks remains limited.
+For example, it is not necessary to fsync() data to disk
+after each request.
+
+> Rationale:
+>
+> The main reason we prevent INTRODUCE replays
+> is to detect attempts by introduction points to mount replay attacks.
+> Such attacks would cause the onion service to make a second circuit
+> to the client's chosen rendezvous point.
+> If the attacker controls both the introduction point
+> and the rendezvous point,
+> they can use this to learn which original user circuit
+> corresponded to the replayed request.
+> This likely helps with traffic analysis somewhat,
+> but is unlikely to