Secret linear congruential generators are not cryptographically secure

Abstract

This paper discusses the predictability of the sequence given by outputing a constant proportion α of the leading bits of the numbers produced by a linear congruential generator. First, we make the assumption that the modulus of the generator is the only known parameter and we prove that, almost surely, a significant proportion of the bits can be predicted from the previous ones, once the generator has been used K times successively where K is O(√log m). Next, we assume that all parameters of the generator are secret and we show how repeated observations of sequences of outputs of length K will probably allow an opponent to cryptanalyze the full sequence.