Proposal Protocol for DME and Airplane Communication

4.3.2 10 minute window
Signature is used for 10 minutes, but this time is variable. Increasing the window size will make it
harder for to verify key Ki it receives in current packet because it has to perform the hash function
to get that key. Shrinking this window reduces the opportunity for recovering the signature.
4.3.3 Last 16 packets in 24 hour window
Sending the signature on the new K0 in last 16 packets of current chain. Increasing the number
reduces the possibility of packet loss, but makes it more difficult for new planes coming into contact
with the DME to verify the end of the previous chain because the signature is for the new chain.
New planes joining at the end of a chain will, in the worst case, need to wait 16 seconds before
they can authenticate data (as opposed to 10 seconds normally). Planes currently using DME are
unaffected by change of chain, unless there is packet loss during the change of chain.
4.4 Plane Verification Process
4.4.1 First Contact with the DME
The plane collects 10 packs from the DME and reconstructs SIGOV ERALL as described above.
After reconstructing, it verifies the signatures. At this point, the plane has authenticated Kw for
the current 10 minutes time window. This means that the plane knows the DME is the DME it
claims to be. When the next packet P , which contains [datai, Ki, ti+1, F(i)], is received, the plane
checks that H(H(H..H(Ki)..)) = Kw, otherwise reject the packet if not. The plane can do this
because it knows what time P was transmitted and when Kw was created. After that, the plane
checks verifies that ti (from the previous packet) is equal to MAC(Ki, [datai —— (32-bit time)]).
If it is equal, then output valid, and reject the packet otherwise. If it is valid, that means the datai
is authenticated and can be used securely.
4.4.2 Subsequent contact
The method is the same as above. If there is a gap in chain due to packet loss, the plane waits until
the next packet is received. It ignores that packet but saves ti+1 from it. Then, when the next
packet is received, the plane performs the MAC check described above. It is important to mention
that if an attacker is able to block every other packet, the plane will be unable to authenticate any
packet because we could never get the keys or data from the next packet to authenticate the MAC
field from the previous packet. If the packets happen to be the last packets in 24 hour chain, the
plane collects SIGOV ERALL on the new K0. The plane verifies the signatures and then starts using
the new chain. No interruption in the service is expected. If packet loss occurs and prevents the
acquisition of the signature on K0 from last 16 packets of previous chain, then use signatures on
the new chain to verify K0 as if the packets did not come.
This method is more involved but has less bits. It can be written in about 500 lines of code.
The signature verification is the same speed as above.
References
[1] D. Boneh, H. Shacham, and B. Lynn. Short signatures from the Weil pairing. J. of Cryptology
17(4): p.297-319, 2004.
4