Usage of LCG/CLCG numbers for electronic gambling applications

Several attacks and weaknesses against the Linear Congruential Generator (LCG) have been shown in literature, but not descriptions how these attacks successfully can be used in practice against gaming applications that use LCG values. This paper presents results from implementations of different attack methods against an internet casino roulette game using an LCG. It is shown that the casino cannot prevent attacks by decreasing the interval of reseeding the generator within reasonable limits. The attack methods discussed are the attack by Frieze et al, a brute force attack and an attack called the chosen gap method, the latter introduced in this paper.