The Oraclize API allows users to encrypt a query or part of a query using their public key "to protect data from public scrutiny," to quote their documentation.
The documentation has this to say about replay attacks: "In order to prevent other users from using your exact encrypted query ('replay attacks'), the first contract querying Oraclize with a given encrypted query becomes its rightful 'owner.' Any other contract using that exact same string will receive an empty result."
A few points of clarification:
If I send a computation query where an encrypted API token is one of the arguments, and the other arguments are not encrypted, will an attacker be able to use my API token to make computation queries with different plaintext arguments? The documentation refers to "that exact same string" but it's not clear to me whether that refers to a single argument, or the entire query.
If an attacker does attempt a replay attack using "that exact same string," and Oraclize returns an "empty result" to that user, what exactly has happened behind the scenes? Has Oraclize actually executed the query and then just hidden the result to the caller? If so, that is a problem, because most APIs have a request limit, and an attacker could use this to spam the external API and exceed the token request limit, thereby breaking the smart contract. My specific external API has a limit of 5 requests per second and 1000 requests per day, so this isn't too hard to abuse, especially since each computation query will make multiple requests to the external API.
Does the replay attack protection apply to all the networks, or just mainnet? That is, can someone take my encrypted API token from mainnet and use it on Rinkeby to spam the external API and break my smart contract? Or is the "rightful owner" feature consistent across all the networks?