Satellite Command Uplink Authentication

Attacker Model

Attack mode

Attack rate 1.0 / s

Key length 16 bit

Anti-replay counter

Uplink Status

Accepted (legit)

Blocked (attacks)

Breaches (accepted attacks)

P(key guess success) per try

1 / 65,536

Command link idle…

How it works

Every real telecommand link (CCSDS Space Data Link Security, TC/TM SDLS) authenticates each uplinked command with a keyed Message Authentication Code plus a monotonically increasing counter, so the spacecraft only executes commands that are provably fresh and from the ground segment holding the shared key:

tag  = MAC(key, counter || command)
accept  ⇔  tag_received == MAC(key, counter || command)
        AND counter_received > last_accepted_counter

Replay — the attacker resends a genuine captured (counter, command, tag) triple. The tag is valid, but the counter check rejects it unless the anti-replay counter is switched off — which is exactly why that check exists.
Brute-force key guess — the attacker forges a tag using a randomly guessed key. With an n-bit key the odds of guessing correctly on one try are 1 / 2ⁿ — shrink the key with the slider to see breaches start appearing.
Tamper — the attacker alters the command field of a captured packet but cannot recompute a matching tag without the key, so the MAC check fails deterministically.

This mirrors why real spacecraft command links use long symmetric keys (128+ bits), monotonic counters or timestamps, and periodic re-keying — never command authentication by obscurity alone.

Accepted (authentic) Rejected (blocked attack) Breach (accepted attack)

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.