Predicting nonlinear pseudorandom number generators
Simon R. Blackburn⋆, Domingo Gómez‐Pérez, Jaime Gutiérrez, Igor E. Shparlinski · Mathematics of Computation · 2004
Let p p be a prime and let a a and b b be elements of the finite field F p \mathbb {F}_p of p p elements. The inversive congruential generator (ICG) is a sequence ( u n ) (u_n) of pseudorandom numbers defined by the relation u n + 1 ≡ a u n − 1 + b mod p u_{n+1} \equiv a u_n^{-1} + b \bmod p . We show that if sufficiently many of the most significant bits of several consecutive values u n u_n of the ICG are given, one can recover the initial value u 0 u_0 (even in the case where the coefficients a a and b b are not known). We also obtain similar results for the quadratic congruential generator (QCG), v n + 1 ≡ f ( v n ) mod p v_{n+1} \equiv f(v_n) \bmod p , where