Blum Blum Shub

Blum Blum Shub (B.B.S.) is a pseudorandom number generator proposed in 1986 by Lenore Blum, Manuel Blum and Michael Shub that is derived from Michael O. Rabin's one-way function.

Blum Blum Shub takes the form


 * $$x_{n+1} = x_n^2 \bmod M$$,

where M = pq is the product of two large primes p and q. At each step of the algorithm, some output is derived from xn+1; the output is commonly either the bit parity of xn+1 or one or more of the least significant bits of xn+1.

The seed x0 should be an integer that is co-prime to M (i.e. p and q are not factors of x0) and not 1 or 0.

The two primes, p and q, should both be congruent to 3 (mod 4) (this guarantees that each quadratic residue has one square root which is also a quadratic residue), and should be safe primes with a small gcd((p-3)/2, (q-3)/2) (this makes the cycle length large).

An interesting characteristic of the Blum Blum Shub generator is the possibility to calculate any xi value directly (via Euler's theorem):


 * $$x_i = \left( x_0^{2^i \bmod \lambda(M)} \right) \bmod M$$,

where $$\lambda$$ is the Carmichael function. (Here we have $$\lambda(M) = \lambda(p\cdot q) = \operatorname{lcm}(p-1, q-1)$$).

Security
There is a proof reducing its security to the computational difficulty of factoring. When the primes are chosen appropriately, and O(log log M) lower-order bits of each xn are output, then in the limit as M grows large, distinguishing the output bits from random should be at least as difficult as solving the quadratic residuosity problem modulo M.

The performance of the BBS random-number generator depends on the size of the modulus M and the number of bits per iteration j. While lowering M or increasing j makes the algorithm faster, doing so also reduces the security. A 2005 paper gives concrete, as opposed to asymptotic, security proof of BBS, for a given M and j. The result can also be used to guide choices of the two numbers by balancing expected security against computational cost.

Example
Let $$p=11$$, $$q=23$$ and $$s=3$$ (where $$s$$ is the seed). We can expect to get a large cycle length for those small numbers, because $${\rm gcd}((p-3)/2, (q-3)/2)=2$$. The generator starts to evaluate $$x_0$$ by using $$x_{-1}=s$$ and creates the sequence $$x_0$$, $$x_1$$, $$x_2$$, $$\ldots$$ $$x_5$$ = 9, 81, 236, 36, 31, 202. The following table shows the output (in bits) for the different bit selection methods used to determine the output.

The following is a Python implementation that does check for primality.

The following Common Lisp implementation provides a simple demonstration of the generator, in particular regarding the three bit selection methods. It is important to note that the requirements imposed upon the parameters p, q and s (seed) are not checked.