Why a Nano flight log can be trusted

How our Nano altimeter seals every log it saves, what that stops, and how a club or a contest can use it to accept flights emailed in later without worrying about if the log has been edited.

How can competitions ensure altimeter logs are correct, unedited and reliable?
 On a sports day that means two things: nobody can quietly edit a log after landing, and nobody can turn up with a log recorded somewhere else. We built the Nano so that both can be proved from the file itself, with no trust in the person handing it over. The system also allows for verification using a public key directly, or via the tools on our website.

Three pieces of standard cryptography

The log is protected by the same three building blocks that secure online banking, software updates and SSH, used in the same way they are used there. Nothing here is invented by us, which is the point: the system has been studied in public for decades.

• A fingerprint of the file. As the Nano writes a flight log it runs a SHA-256 hash over every byte: every sample and every header field, including the apogee, the times, the settings, the serial number, the flight number and the device and competitor tags. The result is a 32-byte fingerprint. Change one digit anywhere in the file and the fingerprint is a completly different number.
• A signature over the fingerprint. The Nano then signs that fingerprint with Ed25519, a public-key signature scheme, using a private key that exists only inside the device. The signature is written into the log next to the fingerprint. Anyone holding the matching public key can check that the signature fits the fingerprint; nobody without the private key can make one.
• Encrypted firmware. The Nano's program is stored on the chip under AES-256 and the chip will only run encrypted code. That is where the private key lives. It cannot be read back off the device, and a modified program cannot be loaded in its place.

What travels with every log: the fingerprint of its contents and the signature over it. The private key that makes the signature is on the chip and nowhere else; the public key that checks it can be given to anyone.

What that stops

Edit a log, by hand or with a program, and its fingerprint changes. The signature in the file was made over the old fingerprint, so it no longer fits, and there is no way to make a new one without the private key. The website rejects the file and says why. It does not matter how small the edit is, or whether it is in the data, the header or the settings. It is the same answer for a log that was never made by a Nano at all: a file invented on a computer has no valid signature to carry. Even we can't forge a fake log on the website, and the private keys are not stored on any servers anywhere at any time. 

One metre added to an apogee. The fingerprint is a different number, the signature made over the original no longer fits it, and the log is rejected.

Because the serial number is inside what is signed, a log cannot be moved from one altimeter to another either. And because the raw barometric altitude is kept in its own column, exactly as the sensor recorded it, an official can read the figure the rules are written for directly from the file, next to the processed one.

How strong is it, honestly

There is no known way to break AES-256, SHA-256 or Ed25519 with computers that exist or are foreseeable. Brute forcing any one of them is not a matter of waiting a long time, it is beyond the energy and the time available, and that is why they are the standard choices everywhere security matters. The maths is not the way in.
For every practical purpose, a Nano log is tamper-evident and can be verified by anyone with the public key, without trusting us, our server or the person who sent it.

A competition day

The signature proves a log has not been changed since the Nano saved it. It does not by itself prove when the flight happened, and a pre-recorded flight from last month is the other way to cheat. The Nano has a competitor tag in its settings for exactly this.

The organiser issues each competitor a unique code on the day; the competitor types it into their Nano before flying, which takes a few seconds over USB; and from then on every log that Nano saves carries that code inside the signed header. A flight recorded before the code was issued cannot contain it, and a code cannot be added afterwards without breaking the signature.

Issue, enter, fly, send, verify. Once the code is in the signed header the log can be emailed in a week later and still proves both that it is genuine and that it was flown on the day.

That also takes the pressure off the day itself. Logs do not have to be downloaded under supervision or collected on the field. They can be uploaded that evening, emailed to the organiser, or kept and sent in with a record claim, and the check gives the same answer whenever it is run. The device tag, the flight number and the serial number travel with it, so an organiser can tie a log to an entry without any paperwork beyond the code they issued.

None of this changes what the Nano records. The raw column is untouched, the processed column says what the filters did, and the signature says that nobody else did anything at all. That is the whole idea.


You can verify logs by our website online tool or even our API system too.

The online verification tool
Use this tool for verifying logs and viewing them in detail with ease on our website. 

The API verification tool
Use this tool to mass verify, or automatically verify logs from your own website, or software with ease.

Public verification Key
For offline use in competitions own software please contact us to request the public key, while it is safe to release we only offer it out on a case by case basis, and it is not posted in public.