How to Predict Congruential Generators

Abstract In this paper we show how to predict a large class of pseudorandom number generators. We consider congruential generators which output a sequence of integers s 0 , s 1 ,…, where s i is computed by the recurrence s i ≡ Σ j = 1 k α j Φ j ( s 0 , s 1 ,…, s i −1 ) (mod m ) for integers m and α j , and integer-valued functions Φ j , j = 1,…, k . The predictors know the functions Φ j in advance and have access to the elements of the sequence prior to the element being predicted, but they do not know the modulus m or the coefficients α j with which the generator actually works. We prove that both the number of mistakes made by the predictors and the time complexity of each prediction are bounded by a polynomial in k and log m , provided that the functions Φ j are computble (over the integers) in polynomial time. This extends previous results about the predictability of such generators. In particular, we prove that multivariate polynomial generators, i.e., generators where s i ≡ P ( s i − n ,…, s i −1 ) (mod m ), for a polynomial P of known degree in n variables, are efficiently predictable.