Lower Bounds on the Period of Some Pseudorandom Number Generators

We are interested in obtaining lower bounds on the periods of two standard pseudorandom number generators from number theory—the linear congruential generator, first introduced by D. H. Lehmer, and the so called power generator. For the former, given integers e, b, n (with e, n > 1) and a seed u = u0, we compute the sequence ui+1 = eui + b (mod n). For the power generator, given integers e, n > 1 and a seed u = u0 > 1, we compute the sequence ui+1 = u e i (mod n) so that ui = u ei (mod n). The particular case e = 2 is known as the Blum–Blum–Shub (BBS) generator [1]. This generator is not only simple to compute, but it has certain attractive aspects from a cryptographic perspective, especially when n is the product of two large primes that are both congruent to 3 modulo 4. These two generators give rise to (ultimately) periodic sequences, and it is of interest to compute the periods—a useful pseudorandom number generator should have a long period. Further, to show that the sequence satisfies various equidistribution properties, exponential sum techniques are often applicable provided that the period is sufficiently large. Moreover, if the period is very short when n is a product of two primes, certain cycling attacks on the RSA public key system apply. In this note we consider the problem of the period statistically as n varies, either over all integers, or over certain subsets of the integers that are used in practice, namely the set of primes and the set of “RSA moduli,” that is, numbers which are the product of two primes of the same magnitude.