A pseudorandom number generator (PRNG) is a deterministic algorithm that expands one or more seed values into a fast stream of values that appear random. Reusing the same seed reproduces the same stream exactly. Unlike a true random number generator (TRNG), which samples unpredictable physical phenomena, a PRNG cannot create unpredictability from a known seed. section 2.2 section 2.2.2
Determinism is useful for repeatable tests and reference implementations, but it is a security boundary: an attacker who learns the seed defeats the intended randomness. For cryptographic use, a fast generator should be seeded from a TRNG rather than a hard-coded, guessable, or otherwise weak value. section 2.2 section 2.2.2
A PRNG maintains state. Each generation step transforms the current state, emits a value, and retains the next state for later calls. A simple linear congruential generator (LCG) uses the recurrence Xₙ₊₁ = (aXₙ + c) mod m, where m is the modulus, a the multiplier, c the increment, and X₀ the seed. Its linear relation makes it a useful implementation example, not a secure design. section 2.2.2 section 2.3
Equation 2.3
\[X_{n+1} = \left( a X_n + c \right)\bmod m \label{equation:lcg}\]The LCG recurrence makes each next state a modular linear transformation of the previous value. section 2.2.2
An LCG can be implemented and checked in a direct sequence:
- Store the multiplier, increment, modulus, and current value as generator state. section 2.2.2
- Compute the next state with modular arithmetic for every Generate call. section 2.2.2
- Use a fixed seed only when comparing against known reference output in a test. section 2.2.2
- Use a high-quality TRNG-derived seed when unpredictability matters. section 2.2
Cloning a linear congruential generator
Observed LCG outputs can reveal the generator rather than merely its results. From consecutive outputs, an attacker can derive the increment when the multiplier and modulus are known, derive the multiplier using a modular inverse, and recover the modulus by taking greatest common divisors of expressions built from output differences. With the recovered modulus, multiplier, increment, and current state, a clone generates the same future sequence. A test using a time-based seed still confirms matching outputs between the original and clone. section 2.2.2 section 2.3
Distribution quality and a long period do not make a PRNG cryptographically safe. A cryptographically secure PRNG (CSPRNG) must also resist distinguishing its output from noise and prevent prediction of past or future values from observed output. In an LCG, output is effectively the internal state, so observing a value permits extension of the sequence and algebraic reversal. section 2.2.3 section 2.3
Cryptographic engineering should use CSPRNGs rather than weak language-default PRNGs, seed them with good TRNG output, and periodically reseed them to limit state-extension exposure. Modern NIST SP 800-90A guidance named CTR DRBG, Hash DRBG, and HMAC DRBG as recommended constructions as of 2024. Even generators presented as cryptographically secure require scrutiny: MT19937 state can be recovered from 624 outputs, and DUAL_EC_DRBG constants can permit future-output prediction through a back door. section 2.3 section 3.3
