Partially-known-plaintext attack of a stream cipher based on modular arithmetic I have a function called $F$, using modular arithmetic as does RSA, defined as $$x\mapsto F(x) = g^x\bmod p$$ where $p$ is a 1024-bit prime and $g$ is a generator of $\mathbb Z_p^*$. A secret key $r$ is chosen randomly from all distinct exponents (ie $\mathbb \{0,\dots ,p-1\}$). The encrypted message is computed using a one-time pad stream cipher, with the keystream computed as $$K=F(r)||F(2\cdot r)\dots$$

How do I decrypt the entire message after obtaining $g$, $p$, and the first 1024 bits of plaintext-ciphertext pair?
Whenever you're trying to attack a scheme that is [algebraically] relatively simple like this one, a sensible first step is to write out everything you know. Now, considering the information you've been given, try and substitute things into oneanother, and see where this leads you.



Let $(m,c)$ be the first 1024 bits of the plaintext-ciphertext pair.

Now, some pointers


Given this is a stream cipher, how is $c$ created? In particular, $c=g(m,K)$ for some function $g$. What is this function? Substituting in the data you know, what do you learn?
Write out $F(x)$ and $F(a \cdot x)$. If I tell you $F(x)=y$, calculate $F(a\cdot x)$
Now, consider everything you know. Put it together and finish the problem yourself.