Assume the pseudo-random number generator (bbs) where:
$$ x_{n+1} = x_{n}^2 \pmod{M} $$
where $M = p \cdot q$, $ \, p$ and $q$ primes that are congruent to $3 \pmod{4}$. Thanks to Euler's theorem there is a closed formula:
$$ x_n = \left(x_0^{2^n \pmod{\lambda(M)} }\right) \pmod{M}, $$
where $\lambda$ is the Carmichael function.
Obviously, since it's a sequence of quadratic residues, the output is going to repeat itself.
The objective is to find the exact period (cycle length) of the generator.
Attempt:
We must find the smallest $m \neq 1$ that satisfies:
$$ x_m = \left(x_0^{2^m \pmod{\lambda(M)} }\right) \pmod{M} = x_0 $$
but I have no idea how to do that.
Can someone suggest a method for finding such $m$?