Corroboration Is Not Authentication: Bounding the Receiver-Side Integrity Assurance Available to Unauthenticatable Cooperative Datalinks in Aviation and Maritime Transport

I. Introduction

A safety analyst confronted with an unauthenticated datalink has three honest options: change the protocol, stop using it, or write down what is holding the integrity claim up instead. The literature has spent two decades on the first option and produced a body of workable cryptographic retrofits. Operations has never seriously entertained the second. The third — auditing the assurance that receiver-side plausibility checking actually supplies — is the one that neither community has formalized, and it is the one that every deployed fleet is silently relying on right now.

The occasion for this paper is a pair of advisories published three weeks apart. On August 7, 2026, CISA published ICSA-26-219-01 against Controller–Pilot Data Link Communications (CPDLC) over ATN-B1, all versions affected, five CVE identifiers, mitigation available: none [1]. The lead finding, CVE-2025-71409, is categorized CWE-306, missing authentication for a critical function, and its text is an engineering statement rather than a security one: the absence of authentication for VHF Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances. Four companion CVEs cover unauthenticated link-control frames that terminate sessions individually and by broadcast, and injected status messages accepted as legitimate [1]. On August 25, 2026, CISA published ICSA-26-237-07 against the FURUNO FA-50 Class B Automatic Identification System (AIS) transponder: CVE-2026-59769, use of hard-coded credentials, CVSS v3.1 base score 9.1 with confidentiality impact None and integrity impact High; and CVE-2026-67578, missing authentication for critical function, base score 7.5 [2]. Production of the affected unit ended in October 2020, the vendor states that software updates will no longer be provided, and the recommended residual control is that the vessel be properly locked and managed [2].

Neither advisory describes a system that stopped working. Both describe a system whose integrity claim was never written down. The aviation advisory is careful to say that the findings do not constitute an unsafe aircraft condition but can degrade operational safety margins by increasing workload, delaying safety-critical instructions, and reducing situational awareness [1]. That is a defensible statement, and it is defensible for a specific reason that the advisory does not state: the flight crew and the controller are expected to catch the injected clearance. The maritime advisory's residual control is a door key, which is defensible for the same unstated reason: somebody is expected to notice that the vessel's identity is wrong.

Both defenses are corroboration arguments. Neither is an authentication argument, and the two are not interchangeable. Authentication is a property of the message: it either carries a verifiable binding to an authorized originator or it does not, and the property is independent of who is watching. Corroboration is a property of the deployment: it depends on which other channels are available at the moment of receipt, how much discriminating power each of them has against a falsified assertion, whether the adversary can shape any of them, and whether their collective verdict arrives before the consumer of the message does something irreversible. Corroboration can be excellent. It can also be zero, and it can be zero without anyone noticing, because nothing in the applicable process standards requires it to be enumerated.

Our claim is that this is a tractable engineering problem with a defensible bound, and that the bound is frequently much lower than practitioners assume. The dominant reason is not that individual plausibility checks are weak. It is that most of the checks a receiver performs are computed over fields the adversary authored. Format validity, sequence numbering, checksum agreement, session-state consistency, and — in the maritime case — the identity field itself are all inside the attacker's write authority. They discriminate perfectly against noise and not at all against an adversary who has read the specification. Against an adaptive adversary, effective coverage is set by the channels outside that write authority, and the count of such channels is often one or two, sometimes zero.

The contributions of this paper are as follows.

• A corroboration ledger, an enumeration artifact that lists for each asserted attribute of a message the independent channels available to the receiver, each channel's discrimination coverage, and — the field practitioners omit — whether the adversary can shape the channel's input.
• Five numbered relations that convert the ledger into a naive coverage figure, a common-cause-corrected figure, an adversary-restricted bound we call the corroboration assurance bound, a time-to-irreversible-commitment constraint analogous to the fault-tolerant time interval of automotive practice, and a residual undetected-falsification rate.
• A structural result: shapeable channels contribute nothing to the bound, so the assurance available to an unauthenticatable link is determined entirely by the receiver's access to sensing or judgment the adversary cannot write into, and by whether that access closes in time.
• A worked application to both August 2026 advisories, producing ledgers for an uplinked altitude clearance and for own-ship AIS identity, and six derived requirements traceable to DO-326A/ED-202A, ED-120, IEC 63154, and IACS UR E26/E27.

Section II reviews the background and identifies the gap. Section III develops the framework. Section IV applies it. Section V discusses limitations and where the standards lens stops. Section VI concludes.

II. Background and Related Work

A. Cooperative Links Specified Without Identity

Three broadcast or near-broadcast links carry safety-relevant assertions in transport today, and all three were specified without message authentication. Automatic Dependent Surveillance–Broadcast (ADS-B) has the most thoroughly documented security posture: Strohmeier, Lenders, and Martinovic's survey enumerated the injection, modification, deletion, and jamming attack classes and established that the protocol offers no defense at the message layer [3]; Wu, Shang, and Guo's later survey organizes the decade of proposed countermeasures that followed [4]; and Manesh and Kaabouch quantified the resulting risk posture across attack classes [5]. Sampigethaya and Poovendran had already framed the general problem as one of aviation cyber-physical systems in which the cyber layer's assumptions and the physical layer's consequences are analyzed by different communities using incompatible vocabularies [6].

CPDLC's position is narrower and worse. Gurtov, Polishchuk, and Wernberg documented the absence of authentication and encryption in the deployed datalink and set out the threat classes in 2018 [7]. Smailes and colleagues demonstrated practical attacks with commodity software-defined radio at CPSS 2021, including a man-in-the-middle takeover of an aircraft's session on an attacker-chosen frequency after which arbitrary CPDLC messages could be delivered without alerting the legitimate controller [8]. A 2025 review in the Journal of Transportation Security consolidates the attack taxonomy and concludes that cryptographic message authentication is the missing control [9]. Most recently, a full-stack analysis presented at USENIX Security 2026 built an SDR-based CPDLC ground station and demonstrated uplink injection and large-scale denial of service against certifiable avionics hardware in a laboratory environment [10]. ICSA-26-219-01 is the point at which this research record acquired CVE identifiers [1].

AIS occupies the maritime equivalent. Balduzzi, Pasta, and Wilhoit's ACSAC 2014 evaluation demonstrated ship spoofing, false distress-beacon injection, and vessel-identity manipulation against both the protocol and the online tracking providers built on it [11]. A 2026 survey synthesizes the intervening decade and characterizes the root causes as open VHF broadcast, self-reported data, absent authentication and replay protection, and GNSS dependence [12]. The FA-50 advisory adds a variant the survey literature under-treats: the falsification need not occur over the air at all, because the transponder's identity field is writable from the vessel's own Ethernet segment [2].

B. Cryptographic Retrofits and the Fleet-Lifetime Gap

Proposals to add authentication to these links are neither scarce nor unserious. Goudossis and Katsikas developed an identity-based public-key scheme for AIS that preserves the message format [13]; Kessler demonstrated a protected-AIS capability providing message integrity, timing integrity, and sender authentication [14]; and the VHF Data Exchange System (VDES) offers a forward path with authentication built in, now entering the IMO regulatory framework with carriage provisions expected to take effect in 2028 [15]. On the aviation side, the countermeasure surveys catalogue PKI-based and lightweight-authentication designs for both ADS-B and CPDLC [4], [9].

The gap this paper addresses is not that these designs are unsound. It is that none of them discharges the risk carried by the installed base within the interval that matters. VDES carriage provisions expected in 2028 do not change what a Class B transponder discontinued in October 2020 transmits tomorrow [2], [15]. A PKI for CPDLC does not change what ATN-B1 accepts on an active frequency this afternoon [1]. The advisories' "no mitigation available" is, read precisely, a statement that the protocol-layer options are unavailable to the fleet in service. Everything that protects that fleet in the interim is receiver-side, and that is exactly the layer no standard requires anyone to enumerate.

C. Corroboration as a Detection Strategy

The technical means of receiver-side corroboration are well developed, and it is worth noting that they were developed as detection research rather than as assurance allocation. Strohmeier, Lenders, and Martinovic showed that wide-area multilateration can validate ADS-B position claims against independently measured time-difference-of-arrival, because an adversary can control what an aircraft reports but not where a transmission physically originates [16]. The same logical structure appears in navigation: Psiaki and Humphreys's treatment of GNSS spoofing and detection organizes defenses by which physical property of the signal the spoofer cannot simultaneously satisfy [17], and receiver autonomous integrity monitoring generalizes the idea to cross-checking redundant measurements. In the maritime domain, the AIS anomaly-detection literature reviewed by Ribeiro, Paes, and de Oliveira applies kinematic and behavioral models to reported tracks [18], and machine-learning intrusion detection for ADS-B continues to develop [19].

Every one of these techniques is a corroborating channel in the sense used here. What the literature does not supply is the allocation step: a statement of how much assurance a given deployment's channels collectively provide, expressed in a form a safety case can consume, with the adversary's ability to shape individual channels made explicit.

D. Safety and Security Co-Assurance

The co-engineering literature has correctly identified that safety analysis and security analysis produce incompatible artifacts and must be reconciled. Kriaa and colleagues surveyed the combined approaches available to industrial control systems [20]; Lisova, Šljivo, and Čaušević's systematic review characterized thirty-three co-analysis methods by lifecycle stage, standards association, and validation status [21]; and Kavallieratos, Katsikas, and Gkioulos surveyed the cyber-physical co-engineering landscape more broadly [22]. Johnson and Kelly's assurance framework for independent co-assurance, and its later Bayesian-network instantiation against IEC 61508 and Common Criteria, address the structural question of how two assurance arguments with different epistemic bases can be combined without one silently absorbing the other [23], [24].

This body of work supplies the frame within which our contribution sits, and it stops short of the specific quantity we need. Co-analysis methods tell an analyst that a security-caused failure must be represented in the safety argument. They do not tell the analyst how much credit a plausibility monitor may claim against an adversary who authored the message the monitor is inspecting. That number is what a residual-risk statement requires and what the two August 2026 advisories implicitly assert without computing.

E. The Gap in One Sentence

No current standard requires the enumeration of the corroborating channels on which an unauthenticatable link's integrity claim depends, and consequently no current safety case states the coverage, the adversary-shapeability, or the latency of the mechanism that is actually holding the argument up.

III. Approach: The Corroboration Assurance Bound

A. Objects and Definitions

Let a message m carry an asserted attribute a — an altitude clearance, a reported position, a vessel identity — to a consumer that will take an action conditioned on a. Let S = {1, …, N} index the corroborating channels available to the receiver: sources of evidence, other than the message itself, that bear on whether a is true.

Definition 1 (Discrimination coverage). Channel i has discrimination coverage c_i in the unit interval against a falsification of a if, conditioned on a being falsified, channel i produces a verdict inconsistent with a with probability c_i.

Definition 2 (Shapeability). Channel i is shapeable by an adversary A if A can influence the channel's input so as to make its verdict consistent with the falsified a. Write U ⊆ S for the unshapeable subset.

Definition 3 (Time to irreversible commitment). For a consumer action conditioned on a, t_commit is the interval from message acceptance to the first moment at which the action's effects can no longer be withdrawn without harm.

Definition 2 is the load-bearing one and it is the field practitioners routinely omit. A checksum has near-unit coverage against random corruption and zero coverage against an adversary, because the adversary computes it. A sequence number, a session identifier, a Current Data Authority designation, and a self-reported identity field are all in the same category. They are not weak checks; they are checks against the wrong initiating event. Fig. 1 draws the resulting architecture, with the shapeable channels distinguished from the unshapeable ones.

B. Naive and Common-Cause-Corrected Coverage

If the channels were mutually independent, the probability that at least one produces an inconsistent verdict would be the standard series-detection expression

Relation (1) is the figure practitioners reach for and it is optimistic in two distinct ways. The first is ordinary common-cause dependence, familiar from hardware safety analysis: a single condition — an operator's saturated attention, a shared time reference, a common GNSS source, a single display surface — can defeat several channels at once. We import the beta-factor treatment used in dependent-failure analysis and write the corrected coverage as

where β in the unit interval is the fraction of falsification events in which the channels fail as a group rather than individually. The second term states the conservative position that under a common-cause condition the ensemble is worth no more than its single best member.

C. The Bound Under an Adaptive Adversary

The second optimism is the one this paper is about. Relations (1) and (2) both sum over S, which tacitly asserts that every enumerated channel is an independent witness. Against an adversary who authored m, the shapeable channels are not witnesses at all: their verdicts are functions of the adversary's own output. Restricting the product to U yields the corroboration assurance bound

Relation (3) is austere and its austerity is the result. It contains no security-specific tuning term. It says only that an adversary who can write a channel's input cannot be detected by that channel, and it follows immediately that Ĉ_adv ≤ Ĉ ≤ C_naive, with the gap between the first and third quantities equal to whatever credit the analysis was taking from the attacker's own arithmetic. When U is empty, relation (3) returns zero and the correct statement about the deployment is that it has no integrity mechanism for a at all — not a weak one.

D. The Commitment Budget

Coverage without timeliness is not a mechanism. Automotive practice formalizes this as the fault-tolerant time interval and its decomposition into fault-detection and fault-reaction budgets; the same decomposition applies here, with the difference that the reaction is frequently performed by a human. Let t_det be the interval from message acceptance to the monitor's verdict, t_dec the interval from verdict to the consumer's awareness, and t_act the interval required to inhibit or reverse the action. The channel contributes assurance only if

Any channel violating (4) is removed from U before relation (3) is evaluated. This is where a great many real corroboration arguments quietly fail. Post-hoc analytics on an AIS track corpus, an ANSP-side correlation of anomalous multi-aircraft logoffs, or a maintenance-time audit of transponder configuration are all valuable and all satisfy (4) for essentially no consumer action of interest.

E. Residual Rate and the Six-Step Procedure

Let Λ_att be the assumed rate of falsification attempts against a in the operational context, and P_act the conditional probability that an undetected falsified assertion produces the hazardous consumer action. The residual is

Relation (5) is included for completeness and carries the heaviest caveat, developed in Section V: Λ_att is not a failure rate and should not be treated as one. Its function is to keep the residual on an axis the safety case already uses, not to forecast attacks.

The procedure is six steps.

1. Fix the assertion and the consumer action. Name the attribute a and the specific action conditioned on it. Different actions on the same message have different t_commit and different P_act.
2. Enumerate channels. List every source of evidence other than m that bears on a. Include human ones explicitly.
3. Classify shapeability. For each channel, ask whether the adversary who authored m can also set the channel's input. Every field carried inside m is shapeable by construction.
4. Assign coverage and timing. Assign c_i and evaluate (4). Channels failing (4) are struck.
5. Evaluate (2) and (3). Report both. The distance between them is the assurance the deployment was claiming from the adversary's own arithmetic.
6. Derive requirements. Where Ĉ_adv is insufficient for the hazard's classification, the requirement is either a new unshapeable channel, a coverage or latency improvement on an existing one, or an extension of t_commit by procedural inhibition.

Table I applies steps 1 through 3 at the link level to the three cooperative links discussed in Section II.

IV. Worked Example

A. An Uplinked Altitude Clearance over ATN-B1

Step 1. The assertion a is "the sector controller has cleared this aircraft to flight level X." The consumer action is the flight crew commanding the level change. Following the advisory's threat description for CVE-2025-71409 [1], the adversary is an SDR-equipped rogue ground station within radio horizon, transmitting a well-formed ATN-B1 uplink on the active VDL Mode 2 frequency. The commitment point is not the crew's acceptance of the message; it is the moment the aircraft's trajectory has diverged far enough that recovery interacts with adjacent traffic. In a high-density sector with reduced vertical separation this is on the order of tens of seconds after the level change is commanded, which sets a demanding t_commit.

Steps 2 and 3. Table II is the corroboration ledger. Five channels are available and three of them are shapeable, which is the finding.

Steps 4 and 5. With all five channels credited and no shapeability correction, relation (1) returns C_naive ≈ 0.998, which is the number an uncritical review would report and is the reason the failure condition looks Minor. Restricting to U = {4, 5} and taking β = 0.2 to represent the workload condition that degrades crew plausibility checking and voice-confirmation discipline simultaneously — a coupling explicitly recognized in the advisory's own language about increased workload [1] — relation (3) returns

The apparent conclusion is comfortable and it is wrong, because channel 5 fails relation (4) under precisely the conditions that make the attack worth mounting. A crew that commands the level change on receipt and confirms by voice afterward has a voice verdict arriving after t_commit. Striking channel 5 leaves U = {4} and relation (3) collapses to Ĉ_adv = 0.55. The deployment's integrity mechanism for an uplinked clearance is one human plausibility check with slightly better than even odds, and the difference between 0.998 and 0.55 is the entire content of this paper.

The aggregate case is worse still. CVE-2025-71411 describes broadcast control frames disconnecting multiple aircraft simultaneously [1]. ED-120's availability allocation for CPDLC is sound for random failure because a proven voice reversion exists; its load-bearing assumption is that outages are uncorrelated with operational demand. An adversary supplies the correlation. Channel 5's coverage is a function of controller availability, and a sector-wide simultaneous reversion to a single voice frequency during a peak window is exactly the condition under which that availability collapses. In the framework's terms, the denial-of-service CVEs are not a separate hazard from the injection CVE; they are a mechanism for driving β toward unity against the injection CVE.

B. Own-Ship Identity on a Class B AIS Transponder

Step 1. The assertion a is "this vessel's MMSI is M." There are two distinct consumers and they must be analyzed separately, which is the structural feature this case contributes.

For the own-ship consumer — the master, who must know what identity the vessel is broadcasting — Table III's ledger is empty. A Class B AIS transponder is a broadcast-only transmitter. There is no loopback, no receive-own-transmission path, no configuration-change annunciation, and no alarm sentence covering a static-data write [2]. U is empty, and relation (3) returns Ĉ_adv = 0 exactly. This is not a weak mechanism. It is the absence of one, and it is why the advisory's residual control has to be physical access management: with no detection channel at all, prevention is the only remaining category.

Step 6 and the regulatory asymmetry. The FA-50's type-approval basis names IEC 62287-1 and ITU-R M.1371, which treat MMSI as a static installation parameter set once at commissioning against a ship station licence [2]. That requirement was satisfied at the human interface — the unit has no front-panel MMSI editor — and unsatisfied at the network interface, which is the gap the two CVEs occupy. IEC 63154:2021, the cybersecurity standard for shipborne navigational and radiocommunication equipment, addresses exactly this class of defect, and was published after production of the affected unit ended in October 2020 [2]. IACS UR E26 and E27 became mandatory for ships contracted for construction on or after 1 July 2024, and the USCG cybersecurity rule at 33 CFR Part 101 Subpart F took effect on 16 July 2025 for vessels already carrying a security plan. A Class B transponder on a workboat is in scope of none of them.

The framework makes the consequence precise rather than rhetorical. AIS is a shared safety service whose achieved Ĉ_adv at any receiver is set by the least-instrumented participant transmitting into the same VHF data link, because the receiving vessel's corroboration channels are the only ones that exist and they do not distinguish a Class A hull inside four regulatory regimes from a Class B hull inside none.

C. Derived Requirements

Table IV states the six requirements the two ledgers produce.

R4 deserves a comment because it is nearly free and would have changed the FA-50 finding's character entirely. The advisory's integrity impact is High on both CVEs and its confidentiality impact is None on both [2], which is the CVSS vector's crude way of saying that this is an authenticity finding on a device whose only output is data. A device that cannot prevent the write can still refuse to make it silent, and an annunciated write moves Ĉ_adv for the own-ship consumer from exactly zero to something bounded below by the operator's attention.

V. Discussion

Coverage figures are judgment, not measurement. Every c_i in Tables II and III is structured engineering judgment. This is a real limitation and it is worth being precise about its scope. The framework's principal result — that shapeable channels contribute nothing and that late channels contribute nothing — is structural and does not depend on the numbers: it holds for any assignment of c_i. What depends on the numbers is only the magnitude of Ĉ_adv once the ledger has been pruned. An analyst who distrusts our figures should still perform steps 1 through 3, because the pruning is where the finding lives. Human-factors literature could supply defensible priors for the crew and controller channels, and multilateration and radar-association coverage are empirically measurable; neither has been done for this purpose.

The coupling factor is the weakest quantitative element. Beta-factor estimation is contested even in hardware dependent-failure analysis, where the coupling mechanisms are physical and enumerable. Here the dominant coupling is operator workload, which the adversary can induce — a property with no analogue in random-failure analysis. Relation (2) treats β as a parameter; the CPDLC case in Section IV-A shows it behaving as a decision variable available to the attacker. A more faithful formulation would make β a function of the adversary's denial-of-service capability, and we regard this as the framework's most important open problem.

Attempt rates are not failure rates. Relation (5) borrows the form of a hazard-rate expression and should not be read as one. There is no defensible base rate for Λ_att, and the advisories are explicit that no public exploitation has been reported [1], [2]. We include (5) because safety cases are organized around rates and a residual expressed in no units at all does not enter the conversation; we do not claim it is predictive. The conservative use is to fix Λ_att at one and read (5) as a conditional statement about what happens when an attempt occurs.

Where the standards lens stops. The most consequential limitation is jurisdictional rather than technical. Both cases place the decisive corroborating channel under a different duty-holder than the equipment. The CPDLC crew and controller channels belong to the operator and the ANSP; the airborne security process specification governs the aircraft. The AIS receiving-vessel channels belong to other vessels entirely, over which the falsified hull's owner has no authority and no visibility. A requirement written under DO-326A can compel an aircraft manufacturer to enumerate channels; it cannot compel the ANSP to keep a controller free enough to answer a voice call. This is the structural reason both advisories close with no mitigation available: the mitigation exists, it is just not in anyone's scope.

Threats to validity. The two cases were selected because they are recent, public, and share the no-mitigation property, which is a deliberate but non-random selection. The framework has not been applied to a case where the corroboration argument turns out to be strong, and such a case would be a more informative test than either presented here. The relations assume a single adversary with a fixed write authority; a coordinated adversary able to compromise a corroborating sensor moves that channel from U to S \ U, which the framework represents but does not help the analyst anticipate.

VI. Conclusion and Future Work

When a cooperative datalink cannot be given message authentication within the service life of the fleet that depends on it, the integrity claim does not disappear. It moves to the receiver, where it is carried by plausibility checks, independent sensing, and human judgment that no process standard currently requires anyone to enumerate. This paper has argued that the resulting assurance is boundable, and that the bound is set by two conditions with no free parameters: an adversary who authors the message cannot be detected by any check computed over that message, and a verdict arriving after the consumer has committed supplies nothing. Applied to CPDLC over ATN-B1, the bound reduces a nominally near-certain ensemble of five checks to a single human plausibility judgment. Applied to own-ship identity on a Class B AIS transponder, it returns exactly zero, which correctly reclassifies the finding from a weak-control problem to a no-control problem and explains why the vendor's residual measure is a physical one.

Three directions follow. First, the coverage figures should be replaced with measurements: crew and controller discrimination against injected clearances is amenable to simulator study, and radar-to-AIS association coverage is amenable to analysis of existing traffic corpora. Second, the coupling factor should be reformulated as an adversary-controlled quantity, which would let a single model express the observation that the denial-of-service CVEs in ICSA-26-219-01 are an enabling condition for the injection CVE rather than a separate finding. Third, the corroboration ledger should be evaluated as a candidate work product for the airworthiness security process and for the maritime equipment cybersecurity standard, since in both domains the artifact that is missing is not an analysis technique but a required place to write the answer down.