How to Predict Congruential Generators

In this paper we show how to predict a large class of pseudorandom number generators. We consider congruential generators which output a sequence of integers k SO.Sl,... where si is computed by the recurrence si r I: ai @j(so,sl,...Si_l) (mod ml for j=l integers m and Ctj , and integer functions @j , j=l,...,k. Our predictors are @cient, provided that the jimctions Oj are computable (over the integers) in polynomial time. These predictors have access to the elements of the sequence prior to the element being predicted, but they do not know the modulus m or the coeflzcients aj the generator actually works with. This extends previous results about the predictability of such generators. In particular, we prove that multivariate polynomial generators, i.e. generators where Si ~Pp(Si,,.. . , si_,> (mod m ). for a polynomial P of fixed degree in n variables, are eficiently predictable.