# Predict math.random(0) last bit

5 messages
Open this post in threaded view
|

## Predict math.random(0) last bit

 ```On Mar 23, 2018, at 6:31 PM, Coda Highland <[hidden email]> wrote: > ````> if you see the least significant bit of 128 consecutive calls to ``> math.random, then you can predict the least significant bit of every ``> call from there on out.``---``I think above statement is only half-right.``Above statement is true ONLY if we already solved``the 128 coefficient of LSFR.``To solve for the coefficients, we need 256 calls.``-> 128 equations with 128 unknown (coefficient)``http://practicalcryptography.com/cryptanalysis/modern-cryptanalysis/lfsrs-and-berlekampmassey-algorithm/`
Open this post in threaded view
|

## Re: Predict math.random(0) last bit

 > To solve for the coefficients, we need 256 calls Uh ..., no need for the 256 calls. Just 1 email to Vigna, and ask for the LSFR coefficients. Since he know last bit is LSFR of degree 128, he must had solved for it.
Open this post in threaded view
|

## Re: Predict math.random(0) last bit

 128 math.random(0) last bit can actually predict the sequence, not just the last bit let c = last bit LSFR coefficients = (c1, c2, ..., c128) let x = last bit of 128 math.random(0) = (x1, x2, ... x128) x129 = (c . x) & 1    -- predict last bit using vector dot product Within the full period 2^128 - 1, all x's are unique (otherwise, last bit period will be LESS than 2^128 - 1) But, xorshift128+ only have 2^128 - 1 possible seeds -> x and seed must map 1-to-1 -> x (after solving the seed) can predict the sequence.