I’ve watched a video where Torsten Grote explains some of it. In fact you’re right when you say it uses the onion address on Tor (I also had assumed that). But he doesn’t explain how the contacts exchange work on a local LAN. I’m not sure it uses the MAC addresses because those are not reliable in the sense that they can be easily spoofed. But maybe I’m wrong because in the end what counts is if the device know the private key or not. Here’s the video: https://media.ccc.de/v/34c3-8937-briar
that “random” string is in fact the Tor hidden service address.