Predicting nonlinear pseudorandom number generators

Abstract

Abstract. Let p be a prime and let a and b be elements of the finite field Fp of p elements. The inversive congruential generator (ICG) is a sequence (un) of pseudorandom numbers defined by the relation u n+1 ≡ au −1 n +b mod p. We show that if sufficiently many of the most significant bits of several consecutive values un of the ICG are given, one can recover the initial value u 0 (even in the case where the coefficients a and b are not known). We also obtain similar results for the quadratic congruential generator (QCG),. This suggests that for cryptographic applications ICG and QCG should be used with great care. Our results are somewhat similar to those known for the linear congruential generator (LCG), x n+1 ≡ axn + b mod p, but they apply only to much longer bit strings. We also estimate limits of some heuristic approaches, which still remain much weaker than those known for LCG.

Predicting Subset Sum Pseudorandom Generators

“…We note that our results resemble those about predictability of various recursive pseudorandom number generators; see [2,3,4,5,8,9,10] and references therein.…”

On the Provable Security of an Efficient RSA-Based Pseudorandom Generator

“…These attacks show that the RSA PRG is insecure when the number of bits output per iteration r is larger than about 2 3 n [5] for e = 2, and about (1 − 1 e(e+1)/2+2 )n [4] in the general case (these results are obtained for r MS bits output per iteration and prime moduli, but we believe that with appropriate modifications they hold also for r LS bits and RSA moduli). We remark that the general case attacks in [4] use low-dimension lattices and are rigorously proven.…”

“…Finally, we also wish to mention the lattice-based attacks of Blackburn et al [5,4] on a class of PRGs having the same iterative structure as our RSA PRG. These attacks show that the RSA PRG is insecure when the number of bits output per iteration r is larger than about 2 3 n [5] for e = 2, and about (1 − 1 e(e+1)/2+2 )n [4] in the general case (these results are obtained for r MS bits output per iteration and prime moduli, but we believe that with appropriate modifications they hold also for r LS bits and RSA moduli).…”

Pseudorandom Bits From Points on Elliptic Curves

“…Jao, D. Jetchev and R. Venkatesan [13, Conjecture 4.1] have conjectured that there exists a positive constant δ > 0 such that for any N ≥ (log q) 2 and any points P = Q the bound…”

“…Many standard pseudorandom number generators based on finite fields and residue rings have proved to be insecure, see [1,2,3,4,5,7,8,9,10,14,15,16]. Partially motivated by this and partially because this is of intrinsic interest for elliptic curve cryptography, several constructions of pseudorandom generators from elliptic curves have been proposed, see [18] for a survey of such constructions and results.…”