Is ADS-B anonymous mode deterministic?

Question

From what I can tell, this is the method of creating a temporary ICAO address in the 978Mhz UAT protocol:

From https://www.icao.int/safety/acp/Inactive%20working%20groups%20library/ACP-WG-C-UAT-2/UAT-SWG02-WP04%20-%20Draft%20Tech%20Manual%20V0-1%20.pdf

3.2.1.5.1.3.2

Self-Assigned Temporary Address of Transmitting Aircraft An “ADDRESS QUALIFIER” value of ONE (binary 001) shall indicate that the message is an ADS-B Message from an aircraft, and that the “ADDRESS” field holds the transmitting aircraft’s self-assigned ownship temporary address.

The self-assigned temporary address shall be generated as follows:

Let:

ADDRP = the ICAO 24-bit address that has been assigned to the aircraft;

ADDRT = the temporary address that is to be generated; M(1) = the 12 least significant bits (LSBs) of the ownship “LATITUDE” field (per §3.2.1.5.2.1) at the time the temporary address option is selected;

M(2) = the 12 least significant bits (LSBs) of the ownship “LONGITUDE” field (per §3.2.1.5.2.1) at the time the temporary address option is selected;

M(3) = 4096 × M(1) + M(2);

TIME = the number of seconds that have elapsed since UTC midnight at the time the temporary address option is selected, represented as a 24-bit number.

Also, let “⊕” denote the modulo 2 bit-by-bit addition(or “exclusive OR”) operation.

a. If the transmitting aircraft’s ICAO 24-bit address ADDRP is available, then the temporary address ADDRT shall be the modulo 2, bit-by-bit summation of the permanent address and M(3), that is:

ADDRT = ADDRP ⊕ M(3).

b. If the aircraft’s 24-bit ICAO address ADDRP is not available, then time of day shall be used as an additional randomizer. In that case, the temporary address ADDRT shall be the modulo 2, bit-by-bit summation of TIME and M(3), that is,

ADDRT = TIME ⊕ M(3).

So the question is if this is deterministic. Could one work their way back to the actual tail number when an aircraft is in anonymous mode?

Answer 1

It is deterministic, meaning that if given exactly the same inputs, it will always produce the same output.

Your second question is whether it is reversible. The algorithm was deliberately designed to require an adversary to know the precise (i.e. within a few meters) latitude and longitude where the algorithm was run to be able to reverse it. This is effectively impossible unless they physically observe your exact startup location, in which case they could presumably just read your tail number off the side of your plane anyway.