Inferring sequences produced by a linear congruential generator on elliptic curves missing high-order bits
Let p be a prime and let E(F(p)) be an elliptic curve defined over the finite field Fp of p elements. For a given point G is an element of E(Fp) the linear congruential genarator on elliptic curves (EC-LCG) is a sequence (U(n)) of pseudorandom numbers defined by the relation: Un = U(n-1) circle plus G = nG circle plus U(0), n = 1, 2,..., where. denote the group operation in E(Fp) and U(0) is an element of E( Fp) is the initial value or seed. We show that if G and sufficiently many of the most significants bits of two consecutive values Un, U(n+1) of the EC-LCG are given, one can recover the seed U(0) ( even in the case where the elliptic curve is private) provided that the former value Un does not lie in a certain small subset of exceptional values. We also estimate limits of a heuristic approach for the case where G is also unknown. This suggests that for cryptographic applications EC-LCG should be used with great care. Our results are somewhat similar to those known for the linear and non-linear pseudorandom number congruential generator.
elliptic curves pseudorandom congruential generators cryptography lattice reduction