Predicting the elliptic curve congruential generator

Abstract

Let $p$ be a prime and let $\mathbf{E}$ be an elliptic curve defined over the finite field $\mathbb{F}_p$ of $p$ elements. For a point $G\in\mathbf{E}(\mathbb{F}_p)$ the elliptic curve congruential generator (with respect to the first coordinate) is a sequence $(x_n)$ defined by the relation $x_n=x(W_n)=x(W_{n-1}\oplus G)=x(nG\oplus W_0)$, $n=1,2,\dots$, where $\oplus$ denotes the group operation in $\mathbf{E}$ and $W_0$ is an initial point. In this paper, we show that if some consecutive elements of the sequence $(x_n)$ are given as integers, then one can compute in polynomial time an elliptic curve congruential generator (where the curve possibly defined over the rationals or over a residue ring) such that the generated sequence is identical to $(x_n)$ in the revealed segment. It turns out that in practice, all the secret parameters, and thus the whole sequence $(x_n)$, can be computed from eight consecutive elements, even if the prime and the elliptic curve are private.