Nonce Design for Safety-Critical Systems: Lessons from a Post-Quantum MAVLink Protocol

Short summary

MAVLink drone systems face replay-attack vulnerabilities in contested environments. CleitonQ uses an atomic compare-and-exchange nonce counter that saturates (not wraps) at u64::MAX, preventing reuse; seeds from wall-clock time on restart to maintain monotonicity. Memory ordering (Acquire/AcqRel on receiver, Relaxed on sender) ensures security without unnecessary synchronization overhead.

• •Replay attacks on drone command links require monotonic nonce validation to prevent spoofing
• •Atomic nonce design must saturate rather than wrap at u64::MAX to fail safely, not silently
• •Memory ordering strategies differ between sender (Relaxed) and receiver (AcqRel) based on actual synchronization needs

Generated with AI, which can make mistakes.