Inferring sequences produced by a linear congruential generator missing low-order bits
An efficient algorithm is given for inferring sequences produced by linear congruential pseudorandom number generators when some of the low-order bits of the numbers produced are unavailable. These generators have the formXn=aXn−1+b (modm). We assume that the constantsa,b, andm are unknown, and thatt=O(log logm) of the low-order bits are not used.
Key wordsCryptography Pseudorandom number generators Linear congruential method
Unable to display preview. Download preview PDF.
- Boyar, J., Inferring sequences produced by pseudo-random number generators,J. Assoc. Comput. Mach., Vol. 36, No. 1, January 1989, pp. 129–141.Google Scholar
- Frieze, A. M., Hastad, J., Kannan, R., Lagarias, J. C., and Shamir, A., Reconstructing truncated integer variables satisfying linear congruences,SIAM J. Comput., Vol. 17, No. 2, April 1988, pp. 262–280.Google Scholar
- Frieze, A. M., Kannan, R., and Lagarias, J. C., Linear congruential generators do not produce random sequences,Proc. 25th IEEE Symp. on Foundations of Computer Science, 1984, pp. 480–484.Google Scholar
- Knuth, D. E.,Seminumerical Algorithms, The Art of Computer Programming, Volume 2, Addison-Wesley, Reading, MA, 1969.Google Scholar
- Knuth, D. E., Deciphering a linear congruential encryption,IEEE Trans. Inform. Theory, Vol. 31, 1985, pp. 49–52.Google Scholar
- Lagarias, J. C., and Reeds, J. A., Unique extrapolation of polynomial recurrences,SIAM J. Comput., Vol. 17, No. 2, April 1988, pp. 342–362.Google Scholar
- Plumstead, J. B., Inferring a sequence generated by a linear congruence,Proc. 23rd IEEE Symp. on Foundations of Computer Science, 1982, pp. 153–159.Google Scholar
- Stern, J., Secret linear congruential generators are not cryptographically secure,Proc. 28th IEEE Symp. on Foundations of Computer Science, 1987, pp. 421–426.Google Scholar