What 19 Years of GPS Ciphertext Reveals About Key Rotation
If the GPS special message field is a cryptographic key distribution channel, then the rate at which those keys change is an operational security parameter — and it is measurable from the public data. This post characterizes the full rotation interval distribution across 19 years of Subframe 4, Page 17 observations, broken down by operational era, and finds two distinct regimes separated by a clean break in 2022.
How we measure rotation intervals
Each unique 22-byte payload is treated as a distinct key epoch. Duration is measured as the span between the first and last observation of a given message hash across all satellites and ground stations in the dataset. Messages observed on only a single day are treated as same-day events and excluded from duration analysis. This leaves 3,586 messages with measurable multi-day spans out of 3,994 total.
Two distinct operational regimes
The data splits cleanly into four eras, and two of them are operationally interesting:
| Era | Period | Median duration | Messages |
|---|---|---|---|
| Pre-OTAD | 2007–2010 | 67h (2.8d) | 288 |
| Transition | 2011 | 23h (1.0d) | 270 |
| Operational OTAD | 2012–2021 | 23h (1.0d) | 2,646 |
| Modern Era | 2022–present | 45h (1.9d) | 382 |
The transition from ~24h to ~45h median duration happened abruptly in 2022. The year-by-year median plot makes this unambiguous — there is no gradual drift, just a step change. This either reflects a deliberate policy decision to slow key rotation (perhaps as the fleet transitioned to new cryptographic infrastructure), or a change in how GFZ’s ground stations were capturing data. The fleet-synchronization behavior did not change, which makes a data artifact less likely.
The clock-alignment test
One of the more interesting sub-analyses is the modulo-24h test on the operational era. If rotations happened on a fixed daily schedule — say, every day at 0000 UTC — you would expect durations to cluster at multiples of 24 hours, and the mod-24h distribution would spike near zero. The operational era data is near-flat, which means key material was not rotating on a fixed clock schedule. Rotations appear to be event-driven rather than time-driven, or if time-driven, not aligned to any simple UTC period.
This is a meaningful operational inference. A fixed rotation schedule is predictable by an adversary. An irregular or event-driven schedule is harder to anticipate.
Outliers
A handful of messages persisted for weeks. The longest observed duration in the pre-OTAD era was 633 hours — over 26 days. The operational era is tightly bounded (max 38h, meaning no message survived a full two days in that period), while the modern era has seen messages persist up to 442 hours. These long-duration modern-era messages are worth watching — they may reflect reduced operational tempo, infrastructure maintenance windows, or something else entirely.
Post three covers the structural anomaly that appeared in December 2023 — a subset of messages that are not ciphertext at all.
Dataset: GFZ Potsdam GNSS navigation-bit archive via Murdoch (2026), DOI 10.5281/zenodo.20073222. All analysis is traffic analysis only.