Why signing matters

Plain MAVLink has no authentication. Anything on the same Wi-Fi network can send your aircraft "arm" or "go there". MAVLink 2 message signing adds a cryptographic signature and a timestamp to every frame. The autopilot ignores commands that are unsigned, wrongly signed or replayed.

So Drone Horizon commands a real aircraft only when the link is authenticated:

  • MAVLink 2 signing, verified in both directions. The app signs what it sends. It also checks that the aircraft's frames carry valid signatures, and keeps checking: if no signed frame arrives for 3 seconds, the link counts as unsecured again.
  • A DJI aircraft on its wired remote. The phone is plugged into the remote, and DJI's own radio link carries the commands.

Without either, the console shows Security: UNSECURED. You get telemetry, video and logs, and every command button stays disabled. Fly with your RC as usual.

Set up signing

  1. Choose a passphrase. In Real Flight → My Real Drone, enter it in the MAVLink signing passphrase field. It is stored only on this phone, for this aircraft profile.
  2. Give the same key to the autopilot. The key is the SHA-256 hash of the passphrase, the same method Mission Planner uses. Either:
    • Recommended: connect the flight controller to a PC by USB and set up MAVLink signing in Mission Planner with the same passphrase; or
    • connect in Drone Horizon and use Hold: Send signing key in the console.
  3. Reconnect. The console's Security row should read MAVLink 2 signed link.

Use Send signing key only on the bench, over a link you trust. That one message carries the key unencrypted, as the MAVLink standard defines.

If it stays unsecured

The Security row tells you which step is missing:

Message Meaning
Unsigned link: set a signing passphrase to fly No passphrase in this drone profile
Aircraft is not signing yet: send the signing key once over USB The app signs, but the aircraft does not. The key was never stored, or the passphrase differs
No recent signed frames from the aircraft The aircraft signed earlier but has gone quiet or is sending frames that fail verification

If the passphrases differ, the aircraft's frames fail verification and the app counts them as rejected. Re-enter the same passphrase on both sides.

What was tested

Signing was tested against real ArduCopter firmware in software-in-the-loop simulation:

  • the app's Send signing key stored the key, and ArduPilot then signed its frames;
  • signed arm, takeoff and land commands from the app were accepted;
  • an unsigned arm command, and one signed with the wrong key, were both ignored.

PX4 also supports MAVLink 2 signing, but we have not yet tested it against PX4. No physical aircraft has been tested yet.

Your controller must be trusted too

The app also checks where its stick input comes from. Wired controllers and touch are accepted. A home-built Wi-Fi controller must be paired, which authenticates every packet. Unpaired Wi-Fi boards only work in the simulator. See Hardware Center.