Attacking the Pollard Generator

Let p be a prime and let c be an integer modulo p. The Pollard generator is a sequence (u_n) of pseudorandom numbers defined by the relation u_n+1equivu_n ²+c mod p. It is shown that if c and 9/14 of the most significant bits of two consecutive values u_n,u_n+1 of the Pollard generator are given, one can recover in polynomial time the initial value u₀ with a probabilistic algorithm. This result is an improvement of a theorem in a recent paper which requires that 2/3 of the most significant bits be known