This paper considers the problem of designing physical watermark signals to protect a control system against replay attacks. We first introduce the replay attack model, where an adversary replays the previous sensory data in order to fool the controller to believe the system is still operating normally. The physical watermarking scheme, which leverages a random control input as a watermark to detect the replay attack is introduced. The optimal watermark signal design problem is then proposed as an optimization problem, which achieves the optimal trade-off between the control performance and attack detection performance. For the system with unknown parameters, we provide a procedure to asymptotically derive the optimal watermarking signal. Numerical examples are provided to illustrate the effectiveness of the proposed strategy.