State recovery of Micalli-Schnorr random number generator modulo a prime Let $p$ be a public prime of $n$ bits. Define the sequence $x_i=z_{i-1}^e \bmod p$, where $z_i$ is the $k$ high-order bits of $x_i$, and $r_i$ the remaining $n-k$ bits of $x_i$ (thus $z_i=\Big\lfloor\frac{x_i}{2^{n-k}}\Big\rfloor$ and $r_i=x_i\bmod2^{n-k}$).
Suppose $k&gt;\max(2n/e, s)$, for some security parameter $s$ and $e$ is public with $\gcd(e,p-1)=1$.

I'm looking for an efficient algorithm to recover $x_0$ from the sequence $r_0, r_1, \ldots r_n$, or to predict remaining terms in the sequence.
EDIT: The answer below answers the RSA modulus case…

There is some related discussion in the answers to the Crypto.SE question “Why is the following RSA PRNG cryptographically secure?”. 

Edit: As pointed out in comments, this answer is about the zRSA
The consensus among the answers seems to be that the required security assumption is too strong (strong RSA assumption) and the generator is too slow for practical use.

Here is a paper "On the Provable Security of an Efficient RSA-Based Pseudorandom Generator" by Steinfeld et. al. on this generator.

Let $N$ be the RSA modulus involved, $e$ the RSA public exponent, and $k$ the number of MSB bits taken from the generator at each iteration.

Basically  the authors suggest that under the strong RSA assumption it is possible to extract $$k= ((1/2)-(1/e))\log N$$  bits per iteration, without affecting the security.

And there is more recent work, behind a Springer paywall (see preprint here) "Time/Memory/Data Tradeoffs for Variants of the RSA Problem" by Fouque et. al. LNCS vol. 7936,
proposing Time/Memory/Data attacks on the generator, which for practical choices of the parameters is of course not a feasible attack. This latter paper also cites a paper by Hermann and May from ASIACRYPT 2009 in the introduction, where it has apparently been shown that if $$k\geq (1-(1/e))\log N$$ bits are extracted per iteration, the generator can be broken.