Simultaneous Security of Bits in the Discrete Log

Abstract

We show that c log log P simultaneously secure bits can be extracted from the discrete log function. These bits satisfy the next-bit unpredictability condition of Blum and Micali. Therefore we can construct a cryptographically secure pseudo random number generator which produces c log log P bits per modular exponentiation under the assumption that the discrete log is hard.