Blum Blum Shub Pseudo-Random Generator Requirements I am trying to understand the Blum Blum Shub pseudo-random generator originally described in A Simple Unpredictable Pseudo-random Number Generator

As best I can tell the requirements are:


For any $x_i$, only $x_i^2 \bmod 2$ is used (only the least significant bit)
$x_{i+1} = x_i^2 \bmod N$
$N = p\cdot q$
$p \ne q$
$p$ and $q$ are equal length primes
$p \equiv 3 \pmod 4$
$q \equiv 3 \pmod 4$
$\gcd(pq, (p-1)(q-1)) = 1$


I don't plan to roll my own crypto. Just curious.
Your understanding of the requirements are correct. To elaborate, the first requirement you specify can be explained as taking the parity of $x_i$. Also, the two primes are called Blum primes and the modulus is called a Blum integer, which means $p,q \in \mathbb P$, $p \equiv q \equiv 3 \pmod 4$, and $N = p \cdot q$.
There are a few other requirements, such as choosing a random $p$ and $q$ of approximately equal length (essentially the same requirements for generating RSA primes, modulo congruence relations). The initial seed, $x_0$, must also be sufficiently large and must be kept secret along with the primes. Finally, $p$ and $q$ are typically chosen such that $\gcd(\varphi(p),\varphi(q))$ is small in order to maximize cycle length. They must be strong primes, usually done by choosing safe primes (integer $p$ is a safe prime if $p,(p-1)/2 \in \mathbb{P}$) as the period divides $\lambda(\lambda(N))$, which results in short cycles if smooth.
If you wish to calculate any $x_i$ value directly from $x_0$ without first calculating $x_1 \cdots x_{i-1}$, you can use Euler's theorem to do $x_i = (x_0^{2^i \bmod \lambda(N)}) \bmod N$. Because of $\lambda$, you need to keep $p$ and $q$.
As usual, $\varphi$ refers to the Euler totient function and $\lambda$ refers to the Carmichael totient function.

Note that BBS is not a good CSPRNG. It is interesting from an academic perspective, but it does not provide a practical level of security, especially with realistic modulus sizes. It is also very slow.