Galileo Open Service Navigation Message Authentication

GALILEO
Title	Galileo Open Service Navigation Message Authentication
Edited by	GMV, European Commission
Level	Basic
Year of Publication	2026

OSNMA (Open Service Navigation Message Authentication) is Galileo’s navigation message authentication service. It is provided worldwide and free of charge. Its purpose is to give receivers the assurance that the received navigation data (ephemerides, clocks, satellite status, timing and other parameters) originates from the Galileo system itself and has not been modified, thereby increasing the ability to detect spoofing attacks.

The Galileo OSNMA concept design took place between 2013 and 2015, followed by its formal introduction into the Galileo legal basis and service baseline. Following the development phase, the OSNMA Internal Testing phase started in October 2020. The OSNMA Public Observation Phase began in November 2021, and finally the Initial Service was declared Operational on 24 July 2025, becoming the first authentication service offered by a GNSS.

Introduction to Galileo OSNMA

Galileo OSNMA provides authentication of the Open Service navigation message transmitted in the E1 band. It uses a 40-bit field of the Galileo E1-B data message (I/NAV), previously unused, and therefore backward compatible with older versions of the Galileo OS Signal-in-Space ICD. OSNMA transmits Message Authentication Codes (MACs) authenticating the navigation data and the related keys with a delayed disclosure of more than 30 seconds. The current OSNMA field is composed of two parts:

• The Header and Root Key (HKROOT) section (first 8 bits) includes the global headers and the Digital Signature Message (DSM), with information to authenticate the TESLA Root Key and other cryptographic material.
• The MAC and Key (MACK) section (next 32 bits) contains the Message Authentication Codes (MACs) and associated keys.

OSNMA field in I/NAV word

Galileo OSNMA cryptographic functions and protocols

The Galileo OSNMA protocol is based on existing cryptographic standards adapted to GNSS. Its core is based on lightweight cryptography standards, in particular an adaptation of the Timed Efficient Stream Loss-Tolerant Authentication (TESLA) protocol. TESLA is particularly suitable for OSNMA because it requires relatively low bandwidth for authentication data and is robust to data loss. However, as a delayed-key-disclosure protocol, it requires the receiver to have a sufficiently accurate time estimate before processing OSNMA data.

The TESLA implementation used for Galileo OSNMA has two main optimizations with respect to the standard protocol. Firstly, it uses a single key chain for all the satellites, so users will be able to receive the key by any satellite in view. Secondly, satellites transmitting OSNMA can “cross-authenticate” other satellites.

TESLA uses a one-way chain of cryptographic keys generated by repeatedly applying a one-way function based on a cryptographic hash. The one-way property makes it computationally infeasible to derive future undisclosed keys from already disclosed keys. But a receiver can verify a newly disclosed key against an earlier authenticated element of the chain. This implies that the receiver must have a previously disclosed key (such as the Root Key) certified as correct.

The TESLA Root Key is authenticated through an ECDSA digital signature using an OSNMA Public Key available to the receiver. Public Keys transmitted through the Signal-in-Space can in turn be authenticated using the OSNMA Merkle Tree, whose root acts as a trust anchor, as per the Galileo OSNMA Signal-In-Space ICD. The required cryptographic material, including Public Keys, Merkle Tree data and associated certificates, is also distributed through the OSNMA Internet Data Distribution (IDD) interface.

Authentication based on Galileo OSNMA

The way in which authentication based on Galileo OSNMA works can be summarized as follows:

• The receiver demodulates the navigation data and the Message Authentication Code (MAC) that will authenticate the navigation data.
• The receiver demodulates the key required to authenticate the MAC. This key is broadcast by the system with a predefined delay with respect to the associated MAC.
• The receiver authenticates the key with a previous key from the chain that is considered authentic, or from the Root Key. As explained before, this key is part of a pre-generated one-way chain whose root is public, and which is transmitted in reverse order with respect to its generation.
• The receiver locally re-computes the MAC with the navigation data and the key, which should match the previously received MAC. If this is the case, the navigation data can be considered as authentic.

The Galileo programme recommends to implement OSNMA in receivers in combination with other anti-spoofing measures. Also, the partial unpredictability of the OSNMA bits can be exploited by suitably designed receivers to provide an additional level of protection at signal/ranging level against certain replay and spoofing attacks.

Galileo OSNMA architecture

A summary of the Galileo OSNMA architecture is shown below. In order to fit Galileo OSNMA into the Galileo infrastructure within schedule and cost, the OSNMA module was developed as part of the European GNSS Service Centre, located in Torrejón de Ardoz.

Galileo OSNMA Architecture

Galileo OSNMA adoption and prospects

During the OSNMA public observation phase (2021-2025), Galileo OSNMA started to be integrated by major receiver manufacturers. This was accelerated at the OSNMA official launch in July 2025. Since then, a growing number of GNSS receivers incorporate OSNMA as part of their anti-spoofing solutions for applications including road transport, timing and synchronisation, surveying, autonomous systems and other professional markets. EUSPA maintains a non-exhaustive list of receivers including OSNMA as part of their list of Galileo compatible devices. OSNMA is also being incorporated as part of the next generation standards for civil aviation by the ICAO (International Civil Aviation Organization), envisaged to become applicable by 2028.

The Smart Tachograph is a special case of early OSNMA adoption. The latest Smart Tachograph Regulations required the implementation of OSNMA as part of its technical specification. Thanks to that, since December 2025, all new heavy vehicles in Europe of more than 3.5 tonnes, like trucks and buses, carry OSNMA.

Galileo OSNMA is the world’s first civil GNSS authentication service, but other satellite navigation systems such as QZSS or GPS have since incorporated or are studying the incorporation of authentication to their signals. Galileo is also testing its new Signal Authentication Service and will improve its overall authentication capabilities as part of its 2^nd Generation.

Credits and further information

This article has been created based on Galileo OSNMA specifications and other information as indicated through references. Further information about OSNMA can be found on the European GNSS Service Centre website. EUSPA also publishes regularly performance reports with the Galileo OSNMA performance in the last quarter. Finally, OSNMA open source packages such as OSNMAlib facilitate implementation of the OSNMA protocol and provide some real-time monitoring capability.