hii,
I’m trying to implement mavlink 2 signing. trying to find the parameter SETUP_SIGNING inside parameters but this parameter not available. Also inside telemetry showing signing off. Please help if anyone know how to use signing feature. I’m using px4 1.17 alpha and qgc 5.0.8 64bit.
nitru
August 5, 2026, 8:41am
2
Hi there,
main ← mrpollo/fix-mavlink-signing
opened 06:16PM - 27 Mar 26 UTC
## Summary
Reworks MAVLink signing to align with the MAVLink specification an… d fix the performance regression reported in #26893.
The previous implementation added a `MAV_SIGN_CFG` parameter that set `MAVLINK_SIGNING_FLAG_SIGN_OUTGOING` unconditionally, running SHA-256 on every outgoing packet even with signing "off." It also restricted `SETUP_SIGNING` to USB only, which is narrower than the spec requires.
## What MAVLink signing protects against
MAVLink signing prevents message injection and spoofing over wireless links. An attacker within radio range cannot send commands to the vehicle or tamper with messages in flight. It does not encrypt messages (telemetry is still readable) and does not protect against physical access to the SD card where the key is stored.
## How it works now
- **Enable**: Send `SETUP_SIGNING` with a valid key on any link. When no key exists, the message is accepted unsigned. When a key is already active, the message must be signed with the current key.
- **Disable**: Send `SETUP_SIGNING` with an all-zero key and timestamp. The message must be signed with the current key. Alternatively, delete `/mavlink/mavlink-signing-key.bin` from the SD card and reboot.
- **Armed guard**: `SETUP_SIGNING` is rejected while the vehicle is armed, for both enable and disable.
- **No key, no overhead**: When no key is present, the signing struct is not wired into the MAVLink library. Zero CPU or bandwidth cost.
- **Key storage**: 32-byte key + 8-byte timestamp stored at `/mavlink/mavlink-signing-key.bin`. Persists across reboots.
- **Propagation**: Key changes on one link propagate to all mavlink instances.
## Changes
- Remove `MAV_SIGN_CFG` parameter
- Only set `MAVLINK_SIGNING_FLAG_SIGN_OUTGOING` when a valid key is present
- Accept `SETUP_SIGNING` on any link, not just USB
- Reject `SETUP_SIGNING` while armed
- Allow disabling signing via signed all-zero key
- Treat duplicate disable as no-op (QGC sends twice for reliability)
- Update signing and security hardening documentation
## Testing
Tested with QGroundControl daily build against PX4 SITL (SIH):
- Enable signing from QGC: key accepted, comms continue signed
- Enable signing while armed: rejected, signing stays off
- Disable signing from QGC: signed blank key accepted, comms revert to unsigned
- Disable signing while armed: rejected, signing stays active
- Key persistence: restart SITL, signing still active, QGC reconnects
- Physical disable: delete key file, restart, signing off, QGC reconnects after disabling its key
Found a QGC-side bug during testing: QGC does not check for `SETUP_SIGNING` rejection and enables local signing unconditionally, causing comms loss when PX4 rejects. Will file separately. https://github.com/mavlink/qgroundcontrol/issues/14250
Fixes #26893
It is not included in v1.17, but only from v1.18 onwards. Consider using the v1.18 alpha/beta, or main.
