Expand description
MAVLink 2 message signing: the signature a sender appends and the check a receiver makes, so a ground station can trust that a command came from the vehicle it expects and was not replayed.
The scheme follows the MAVLink reference exactly. A signed frame carries a 13-byte
block after its checksum: a one-byte link id, a 48-bit timestamp, and a 48-bit
signature. The signature is the first six bytes of
SHA-256(secret_key ++ header ++ payload ++ checksum ++ link_id ++ timestamp), where
the header includes the start marker. The timestamp is in 10-microsecond units since
1 January 2015 GMT and must increase, which is what stops a captured frame from being
replayed to re-arm a vehicle or re-trigger an actuator.
Signer stamps and signs outgoing frames; Verifier checks incoming ones,
tracking a timestamp per (system, component, link) stream so an old or repeated
frame is rejected. SHA-256 is the one primitive borrowed (from sha2), as in
pamoja-session; everything else is built here.
Structs§
- Signer
- Signs outgoing v2 frames with a shared key.
- Verifier
- Verifies signed v2 frames against a shared key, rejecting forged and replayed frames.
Constants§
- DEFAULT_
TIMESTAMP_ WINDOW - The default replay window: one minute, in 10-microsecond ticks.
- KEY_LEN
- The length of a signing secret key, in bytes.
- MAVLINK_
EPOCH_ OFFSET_ SECS - The seconds between the Unix epoch and the MAVLink signing epoch (1 January 2015 GMT).
Functions§
- timestamp_
from_ unix_ micros - Converts a wall-clock time to a MAVLink signing timestamp.