3 ms·

The attacker can do that, but it will be immediately apparent for the receiver. The only thing you can do is a replay attack, which is useless, if the receiver

The attacker can do that, but it will be immediately apparent for the receiver. The only thing you can do is a replay attack, which is useless, if the receiver has a clock that is accurate to within ~1 sec. It'll immediately recognize that the time stream is being tampered with when the next signature is out of whack. You might be able to trick the receiver _once_ into not updating its position for a few seconds. After that, it'll mark the affected satellites as unreliable and will not use them. It's functionally no different from just jamming them.

lxgr 2y ago
Why would the replay attack necessarily be immediately apparent if you start out synchronously and only very slowly build up a delay, especially if combined (as you suggest) with a momentary gap and re-acquisition to mask any unavoidable slight initial delay?
- cyberax 2y ago
  It does not work mathematically. If you delay signals from one satellite, then you need to simulate signals arriving _faster_ from another satellite (on the opposite side of the sky), assuming the receiver is not diving down into the Earth. And you can't do that because you can't predict the timestream. The receiver should be able to detect this inconsistency and try to filter out the faulty signals. To make this attack feasible, you need to "prime" the receiver by delaying ALL the signals, but that is only possible if you control the initial timestamp sync.
  - lxgr 2y ago
    Hence first slowing down everything for a while so the attacker has some headroom for the signals they would need to speed up. Alternatively, just slowing down some signals more than others would still amount to a global slowdown, with some signals being sped up and others slowed down relative to the sum. If all signals drift into the same direction simultaneously, a receiver would just interpret this as its own non-precision oscillator running slightly fast and adapting, right? Even if feasible, this would still be a much weaker threat than that of a completely attacker-chosen location, velocity, and time, but it could still be catastrophic (imagine e.g. introducing a gradual shift to an aircraft's navigation system and nudging it across an international border that way).
    - cyberax 2y ago
      I looked at the spec, and the receiver should be able to detect that. The holdover time should be at least 30 minutes, long enough to witness multiple signatures come in. The timing between them is fixed, so the receiver should be able to detect the attacker slightly delaying the signals. But I certainly believe that the actual receivers might not be hardened enough for that.

lxgr 2y ago

Why would the replay attack necessarily be immediately apparent if you start out synchronously and only very slowly build up a delay, especially if combined (as you suggest) with a momentary gap and re-acquisition to mask any unavoidable slight initial delay?

cyberax 2y ago
It does not work mathematically. If you delay signals from one satellite, then you need to simulate signals arriving _faster_ from another satellite (on the opposite side of the sky), assuming the receiver is not diving down into the Earth. And you can't do that because you can't predict the timestream. The receiver should be able to detect this inconsistency and try to filter out the faulty signals. To make this attack feasible, you need to "prime" the receiver by delaying ALL the signals, but that is only possible if you control the initial timestamp sync.
- lxgr 2y ago
  Hence first slowing down everything for a while so the attacker has some headroom for the signals they would need to speed up. Alternatively, just slowing down some signals more than others would still amount to a global slowdown, with some signals being sped up and others slowed down relative to the sum. If all signals drift into the same direction simultaneously, a receiver would just interpret this as its own non-precision oscillator running slightly fast and adapting, right? Even if feasible, this would still be a much weaker threat than that of a completely attacker-chosen location, velocity, and time, but it could still be catastrophic (imagine e.g. introducing a gradual shift to an aircraft's navigation system and nudging it across an international border that way).
  - cyberax 2y ago
    I looked at the spec, and the receiver should be able to detect that. The holdover time should be at least 30 minutes, long enough to witness multiple signatures come in. The timing between them is fixed, so the receiver should be able to detect the attacker slightly delaying the signals. But I certainly believe that the actual receivers might not be hardened enough for that.