Hacker News Reader

Comment by lukan | Hacker News Reader

"GPS is falling behind Galileo and Beidou as the preeminent GNSS"

I remember, that Galileo went offline a few years ago for some days - and the joke was, no one noticed. So possible that today there are more regular users and possible that there are some advanced features of Galileo like the mentioned

"Galileo’s open service (civil-access) E1 signal incorporates public/private key encryption to digitally sign and authentify data"

But I think GPS falling behind Galileo would imply a bit more Galileo users, compared to GPS. Which would surprise me.

View on HN

They introduced a few useful features that are unique and decided to offer them for free.

Like HAS (30cm precision after some integration time. Without additional correction data) and cryptographic verification of the transmitted GNSS data.

A number of "GPS" receives also received Galileo and Beidou. They then combine all the data to figure out the correct position. Likely the GPS chip in your phone will do more than one system. Any one system alone can provide a position (sort of - Japan has a system that only covers the area around Japan) so the loss of one isn't a problem.

> Galileo’s open service (civil-access) E1 signal incorporates public/private key encryption to digitally sign and authentify data

Which is fairly useless. The spoofed data can be legit data just selectively delayed by a couple of milliseconds and the receiver has no way to know.

Is that actually true here? Satellite constellations move in complicated ways, so a receiver should be able to detect "impossible" configurations if the stream from only one satellite is delayed. If they are all delayed, then wouldn't that also cause the receiver's position to fail to resolve?

An attacker can receive all streams, delay the data from each satellite a variable amount, then retransmit them all again to appear to be in a different location.

Then also delay signals from other gnss providers to match.

I have witnessed this done in Iraq, so someone has already built the capability.

A variable amount is what I was missing. That makes sense now, thanks.

Is that some sort of a replay attack? If so why isn't the timestamp embedded in the encrypted payload

It is.

It relies on the fact the clients clock will have a few milliseconds of error so they'll be unable to detect it.

If the client had an atomic clock, this attack wouldn't be possible.

Reply on news.ycombinator.com