[TVHGC Members] question for Richard or someone from the UK league

Hi

I meet one of the developers of the LK8000.

On a Kono (kindle like) hardware (connected to an external GPS), it runs an application that displays the map, speed and all kind of paragliding information.

The LK8000 is able to sign the GPS tracks.

It uses a "private" key (this is a private seed of a standard Linux MD5 hash).

The LK8000 provides to the FFVL (and other paragliding bodies) a separate program (Linux I think) that is able to validate a signed GPS track. 

Problem: the LK8000 source code is open source, so with a careful reading of the C code, it is possible to read the "private" key and potentially forge a valid GPS trace.

The FFVL is aware of this potential "security" issue, but does not see it as blocking. Rational: someone that can read the source code and forge a valid GPS trace, is potentially able to forge the GPS messages on the serial line going to the LK8000 and therefore build a fake GPS track.

According to the developer I talk to, most of the paragliding national bodies, understand this limitation and accept it.

Only the BHPA (and 2 other countries) refuse to accept a signed GPS track generated from an open source device where the secret key can be found in the source code.

As a workaround, the LK8000 development team added a binary plug-in (i.e. not in open source) that contain the private key and sign the track for the UK league.

So the question (for Richard, or anyone in the UK paragliding league): would it be possible to speak with the BPHA/UK paragliding league to lift this restriction and accept that the private key that sign the GPS track is "visible" in the source code of the open source device ?