RAZAN

01The gap

Authentication is not authorization.

Where the CCSDS link security standard is deployed, a telecommand frame is encrypted, authenticated and protected against replay. Flight software then checks the command against its dictionary, its parameter ranges and the vehicle's mode.

Every one of those checks answers the same question: did a holder of the key produce this frame? None of them answers the second one: was whoever sent it entitled to send this, now?

Authorization exists on the ground, as a procedure between people. It has never existed as a property the spacecraft can verify for itself.

Caveat. For a large part of the fleet the first property is missing too. That is a harder fact for us than for anyone else, and it is the next record.

02The evidence, stated accurately

The famous incident is not our incident.

February 2022, KA-SAT. An intruder reached the trusted management segment through a misconfigured VPN appliance, moved laterally, and ran legitimate management commands against tens of thousands of consumer modems, overwriting key data in their flash memory. Service went dark across Europe within hours.

RAZAN would not have stopped it. No spacecraft was commanded; the target was a ground fleet. We keep the case because the missing property is identical — every command was well-formed, and nothing in the path could ask whether anyone had approved it. The gap is not specific to orbit. Orbit is only where it is hardest to close later.

On the orbital side the honest reference is Willbold and colleagues, who analysed the flight software of three satellites and found standard protections absent. That finding cuts against us as much as for us: where authentication is missing, authentication is the cheaper purchase, and it should come first.

Sources: Viasat, KA-SAT network cyber attack overview, 30 March 2022 / Willbold et al., Space Odyssey, IEEE Security & Privacy 2023 — firmware analysed on the ground, not vehicles inspected in orbit.

03The quorum

Nine seats. Six signatures.

The operator, its ground stations, independent technical seats and an insurer with a restricted vote run one chain together. A command is authorized when six of the nine sign it. Admission to a seat is a contract executed on chain, not a line in a configuration file, and the record cannot be reversed or backdated.

Roles are not symmetric. The insurer votes on discretionary manoeuvres and on nothing else. No commercial party votes on safety.

Level 5, not level 3. CNSA 2.0 approves only ML-DSA-87 for national security systems and excludes SLH-DSA entirely, so the root of trust is LMS. Level 5 costs us 40% more bytes than ML-DSA-65 would. We would rather match the shortlist than the benchmark.

04The packet

Do not sign every command.

A 27 KB certificate does not fit the uplink. A CCSDS telecommand frame carries at most 1,024 octets, and command uplinks commonly run between 1 and 64 kbit/s. Attached to every command, one certificate costs between three seconds and four minutes of a pass — and a low-Earth pass is about ten minutes long.

So the unit of authorization is not the command. Ground builds a Merkle tree over a command batch, the quorum signs the root, and each uplinked command carries its own inclusion proof of a few hundred bytes. One certificate per pass, not per command.

Read the columns as totals for the whole batch, not per item: batching moves the certificate from 40× to 1×. Compact post-quantum aggregation would remove the problem at source, but every aggregation scheme in production today is elliptic-curve based and therefore not post-quantum. It is an open problem and an explicit work item. Batching is what ships in the meantime.

05On board

One gate, and a default.

The spacecraft keeps its link security and gains a single check: verify the post-quantum signature, then the quorum certificate and the command's inclusion proof. Absent or invalid, the command does not execute.

Verification is small, with an asterisk. A memory-optimised ML-DSA implementation verifies in under 3 KB of working memory, while the reference implementations in pqm4 need 50–100 KB — so the figure belongs to one specific implementation, which then has to survive flight qualification. And the verifier is not the binding line anyway. The certificate buffer is.

06When it must not refuse

The failure that loses spacecraft is silence.

Refusing by default turns an unavailable quorum into a mission risk. This is the first question a flight operations director asks, so it gets an answer here rather than in a review.

Each of these reopens part of the hole the rest of the system closes. We think it is the correct trade, and we would rather argue about it in the open than discover it at a design review.

07The boundary

What this does not stop.

The binding is between a command hash and six signatures. It is not a claim that six institutions understood what they signed. Rendering a command in a form a human seat can actually review is the harder half of this product, and it is not cryptography.

08The proof

Verified from outside. Read by nobody.

Each confirmed authorization emits a one-way proof to a public chain over Avalanche Interchain Messaging: a hash, a timestamp, and the consensus signature of the authorizing chain. The command never leaves the classified side and nothing crosses back.

An oversight body or an insurer verifies that every order executed in orbit was properly authorized — without seeing the order, the target, or the capability behind it.

Where the post-quantum line actually is. Only the certificate the spacecraft checks is post-quantum, anchored to keys loaded before launch. The chain's own consensus, the P-Chain validator registry and this outbound proof are BLS and elliptic-curve — not post-quantum. An adversary holding a cryptographically relevant quantum computer could forge the audit record. They could not forge a command. We would rather draw that line than imply it runs everywhere.

09Why a chain at all

The spacecraft never reads the chain.

That is the honest starting point, so we will make the objection ourselves. On board, this is M-of-N signature verification against nine public keys loaded before launch. You can build that with an HSM-backed PKI and a transparency log, no chain anywhere, and it would certify for flight sooner.

What the chain buys is on the ground. Admission of a seat becomes a contract rather than a configuration change. The ordering of authorizations is not in any single operator's gift. And the audit log is not written by the party being audited. A transparency log gives you the third. It does not give you the first two without appointing somebody to run it — which is the question a chain answers.

An application chain on Cosmos is the closest alternative and we do not claim this is impossible elsewhere. Elsewhere you assemble each property separately. On the consensus claim we are deliberately careful: Snowman is a probabilistic protocol with negligible reorganisation probability, not a deterministic one, and anyone who tells you otherwise is selling.

10The build, and who signs the order

What gets built.

A spacecraft ordered today is flying past both dates. The sector has to migrate its signature infrastructure regardless, and the argument is simply that the same migration is the cheapest moment to close the authorization gap. The insertion point is the post-quantum rework of flight software in new platform designs — not a retrofit to vehicles already in orbit. The signature on the order is a prime contractor's; the cycle is three to seven years; the operator has to want it first.

Both dates come from NIST IR 8547, which was published as an initial public draft in November 2024. Treat them as a schedule, not a statute, and check the current status before quoting us. Every phase above ends in something a stranger can check without asking us, and the post-quantum precompile module is reusable by any Avalanche L1 that needs FIPS-standard verification — the part of this work that outlives the application.