Automatic Dependent Surveillance–Broadcast (ADS-B) is the backbone of modern air traffic surveillance, broadcasting an aircraft's identity, position, and velocity in the clear, with no authentication. This makes it trivially spoofable: anyone with a low-cost software-defined radio can inject fake aircraft or impersonate real ones, threatening both safety and security as airspace grows more congested and automated.

AuthADS solves this without requiring new hardware or breaking compatibility with the thousands of ADS-B receivers already deployed worldwide. It combines two lightweight cryptographic primitives: forward-secure hash chains, which let each broadcast carry a compact authentication tag derived from a one-way chain of hash values, and LMS (Leighton-Micali) signatures, a NIST-standardized, post-quantum-secure signature scheme, used periodically to anchor the chain to a trusted root.

A ground-based trust server generates the initial chain commitment (K0) and periodically re-anchors it using LMS signatures. Aircraft broadcast the next hash-chain value alongside their normal ADS-B payload, fitting the authentication data into unused bits of the existing message format (Type Code 27) — meaning legacy receivers simply ignore it, while upgraded receivers can verify authenticity in real time. A sliding-window verification scheme, with late-join handling, allows receivers to synchronize with an aircraft's chain even if they start listening mid-flight.

We built and tested a full working prototype: a sender/receiver pipeline in Python, with remote-mode support so that authentication can be demonstrated live across separate machines over a network, using LMS public-key verification.

Unlike prior post-quantum ADS-B security proposals, AuthADS's design goal is deployability: no new spectrum, no aircraft hardware upgrades, no backward-compatibility break, and low computational overhead suitable for constrained avionics. It offers meaningful protection against both current spoofing attacks and future quantum-capable adversaries, at a fraction of the complexity of full public-key-per-message schemes.

AuthADS was developed as a submission to the Airbus Fly Your Ideas 2026 competition and has been assessed as a genuinely novel, publishable contribution to aviation cybersecurity research.