Reconstructing truncated integer variables satisfying linear congruences.

We describe two polynomial time algorithms for reconstructing the values of variable x(1), ..., x(k) when we are given some linear congruences relating them together with some bits obtained by truncating the binary expansions of the variables. The first algorithm reconstructs the variables when either the high order bits or the low order bits of the x(i) are known. It is essentially optimal in its use of information in the sense that it will solve most problems almost as soon as the variables become uniquely determined by their constraints. The second algorithm reconstructs the variables when an arbitrary window of consecutive bits of the variables is known. This algorithm will solve most problems when twice as much information as that necessary to uniquely determine the variables is available. Two cryptanalytic applications of the algorithms are given: breaking linear congruential generators whose outputs are truncated, and breaking the simplest version of Blum's protocol for exchanging secrets.