I have learnt that Linear Congruential Random Number Generators are not cryptographically secure - my understanding is that given an LCG of the form:

```
X_n = (aX_(n-1) + c) mod m

```

It is possible to predict future X\_n given a number of past X\_n (even without knowing a, c, m).

In most implementations however there are a couple of complicating factors:

1. The values returned usually hide a certain number of the least significant bits of X\_n
2. In most cases the values are returned modulo a small integer *p*.

So rather than the internal states themselves we often have only the *high order bits modulo p* of each state.

My question is: is it tractable to predict future values given a number of past values with these restrictions - with proof?

I have found [this paper](https://link.springer.com/article/10.1007/BF02252875?from=SL) by J. Boyar, from what I can work out it only considers point (1) though.

**edit**

@fgrieu has shown that is is indeed quite trivial if we know *a*, *c* and *m* and *m* is a power of two. I'm still interested if there is a more general solution.