system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Decrypt satellite phone traffic by exploiting a weak air-interface cipher (GMR-1/GMR-2)

Grounding:
- SPARTA REC-0003 Gather Spacecraft Communications Information: Threat actors assemble a detailed picture of the mission’s RF and networking posture across TT&C and payload links. Useful elements include frequency bands and allocations, emission designators, modulation/coding, data rates, polarization sense, Doppler profiles, timing and…
- SPARTA REC-0008.01 Hardware Recon: Adversaries seek insight into component sources, screening levels, test histories, and configuration states to prepare pre-delivery manipulation of boards and modules. High-value details include ASIC/FPGA part numbers and stepping, security fuses and life-cycle states, JTAG/SWD…
- SPARTA EXF-0009 Compromised Partner Site: The adversary leverages third-party infrastructure connected to the mission, commercial ground stations, relay networks, operations service providers, data processing partners, to capture or relay mission data outside official channels. From these footholds, the attacker can…
- SPARTA REC-0005 Eavesdropping: Adversaries seek to passively (and sometimes semi-passively) capture mission communications across terrestrial networks and RF/optical links to reconstruct protocols, extract telemetry, and derive operational rhythms. On networks, packet captures, logs, and flow data from…
- SPARTA REC-0008.02 Software Recon: Threat actors enumerate the software factory: where source lives, how dependencies are pulled, how artifacts are built, signed, stored, and promoted to flight. They inventory repos and access models, CI/CD orchestrators, build containers and base images, package registries,…
- SPARTA RD-0002 Compromise Infrastructure: Rather than purchasing or renting assets, adversaries compromise existing infrastructure, mission-owned, third-party, or shared, to obtain ready-made reach into space, ground, or cloud environments with the benefit of plausible attribution. Targets range from physical RF chains…
- SPARTA IMP-0004 Degradation: Measures designed to permanently impair (either partially or totally) the use of a system. Threat actors may target various subsystems or the hosted payload in such a way to rapidly increase it's degradation. This could potentially shorten the lifespan of the victim spacecraft.
- SPARTA EXF-0003 Signal Interception: The adversary captures mission traffic in transit, on ground networks or over the space link, so that payload products, housekeeping, and command/ack exchanges can be reconstructed offline. Vantage points include tapped ground LANs/WANs between MOC and stations, baseband…

Steps so far:
1. Identify the air-interface standard [REC-0003]
2. Intercept and demodulate the downlink [EXF-0003]

Give the single next step.

assistant: 3. Recover keystream and decrypt
   - Technique: REC-0005 Eavesdropping [ST0001]
   - Action: Exploit the weak stream cipher to recover keystream and reconstruct plaintext.
   - Check: decrypted frame matches a known-plaintext control message.