Skip to main content

Module signing

Module signing 

Source
Expand description

MAVLink 2 message signing: the signature a sender appends and the check a receiver makes, so a ground station can trust that a command came from the vehicle it expects and was not replayed.

The scheme follows the MAVLink reference exactly. A signed frame carries a 13-byte block after its checksum: a one-byte link id, a 48-bit timestamp, and a 48-bit signature. The signature is the first six bytes of SHA-256(secret_key ++ header ++ payload ++ checksum ++ link_id ++ timestamp), where the header includes the start marker. The timestamp is in 10-microsecond units since 1 January 2015 GMT and must increase, which is what stops a captured frame from being replayed to re-arm a vehicle or re-trigger an actuator.

Signer stamps and signs outgoing frames; Verifier checks incoming ones, tracking a timestamp per (system, component, link) stream so an old or repeated frame is rejected. SHA-256 is the one primitive borrowed (from sha2), as in pamoja-session; everything else is built here.

Structs§

Signer
Signs outgoing v2 frames with a shared key.
Verifier
Verifies signed v2 frames against a shared key, rejecting forged and replayed frames.

Constants§

DEFAULT_TIMESTAMP_WINDOW
The default replay window: one minute, in 10-microsecond ticks.
KEY_LEN
The length of a signing secret key, in bytes.
MAVLINK_EPOCH_OFFSET_SECS
The seconds between the Unix epoch and the MAVLink signing epoch (1 January 2015 GMT).

Functions§

timestamp_from_unix_micros
Converts a wall-clock time to a MAVLink signing timestamp.