system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Verify the RF link enforces authentication, anti-replay, and confidentiality at the bench

Grounding:
- SPARTA REC-0003 Gather Spacecraft Communications Information: Threat actors assemble a detailed picture of the mission’s RF and networking posture across TT&C and payload links. Useful elements include frequency bands and allocations, emission designators, modulation/coding, data rates, polarization sense, Doppler profiles, timing and…
- SPARTA REC-0005 Eavesdropping: Adversaries seek to passively (and sometimes semi-passively) capture mission communications across terrestrial networks and RF/optical links to reconstruct protocols, extract telemetry, and derive operational rhythms. On networks, packet captures, logs, and flow data from…
- SPARTA DE-0003.10 GPS Ephemeris: A satellite with a GPS receiver can use ephemeris data from GPS satellites to estimate its own position in space. A hostile actor could spoof the GPS signals to cause erroneous calculations of the satellite’s position. The received ephemeris data is often telemetered and can be…
- SPARTA EX-0001 Replay: Replay is the re-transmission of previously captured traffic, over RF links, crosslinks, or internal buses, to elicit the same processing and effects a second time. Adversaries first observe and record authentic exchanges (telecommands, ranging/acquisition frames, housekeeping…
- SPARTA REC-0004 Gather Launch Information: Adversaries collect structured launch intelligence to forecast when and how mission assets will transition through their most time-compressed, change-prone phase. Useful elements include the launch date/time windows, launch site and range operator, participating organizations…
- SPARTA IA-0008 Rogue External Entity: Adversaries obtain a foothold by interacting with the spacecraft from platforms outside the authorized ground architecture. A “rogue external entity” is any actor-controlled transmitter or node, ground, maritime, airborne, or space-based, that can radiate or exchange traffic…
- SPARTA REC-0008.01 Hardware Recon: Adversaries seek insight into component sources, screening levels, test histories, and configuration states to prepare pre-delivery manipulation of boards and modules. High-value details include ASIC/FPGA part numbers and stepping, security fuses and life-cycle states, JTAG/SWD…
- SPARTA EX-0014.02 Bus Traffic Spoofing: Here the adversary forges messages on internal command/data paths (e.g., 1553, SpaceWire, CAN, custom). By emitting frames with valid identifiers, addresses, and timing, the attacker can make subscribers accept actuator setpoints, power switch toggles, mode changes, or…

Decompose this objective into an ordered plan of verifiable steps.

assistant: Plan:
1. Establish the SDR link
   - Technique: REC-0003 Gather Spacecraft Communications Information [ST0001]
   - Action: Configure the SDR to the link frequency and framing and exchange frames with the flatsat.
   - Check: SDR closes the link and a valid telecommand is acknowledged.
2. Verify command authentication
   - Technique: IA-0008 Rogue External Entity [ST0003]
   - Action: Send a telecommand without valid authentication from the SDR.
   - Check: flatsat rejects the unauthenticated command in the flight build.
3. Verify anti-replay
   - Technique: EX-0001 Replay [ST0004]
   - Action: Capture a valid telecommand and retransmit it to the flatsat.
   - Check: flatsat rejects the replayed frame with anti-replay enforced.
4. Verify downlink confidentiality
   - Technique: REC-0005 Eavesdropping [ST0001]
   - Action: Receive and demodulate the telemetry downlink and inspect it for plaintext sensitive fields.
   - Check: sensitive telemetry fields are encrypted, not readable in the capture.