I've looked a bit more into it and there is one PCG type with a 128 bit state, where the output is marginally decoupled from the internal state.
PCG is a suite of algorithms to generate pseudo-random numbers that have been created on top of existing lightweight random number generators so that they:
- stay lightweight;
- pass the various statistical randomness tests;
- are possibly less predictable.
Now only the 3rd part is of interest with regards to cryptography. However, all but one of the algorithms seem to have a state of 64 bit or less (if I discount the one that has been deemed insecure by the author). That makes them directly unsuitable for cryptographic random number generation.
That leaves us with PCG-XSL-RR, the only one that makes any claim to be secure. This seems to have been accomplished by adding a XorShift on the state and a few very simple operations to derive the output of the state:
output = rotate64(uint64_t(state ^ (state >> 64)), state >> 122)
Although there are certainly very simple stream ciphers, it seems to me that we need analysis to see if many outputs cannot be used to derive the state bits. As long as that analysis is not performed, just stating that it might be secure, and that the prediction difficulty is "challenging" doesn't make a cryptographically secure algorithm.
Personally calling it "secure" is therefore unwarranted. Listing the prediction difficulty as "challenging" means using weasel words to indicate that no sufficient analysis is performed and that the security of the algorithm is unknown. If the state can be retrieved then the algorithm would be fully predictable after all. Without knowing the details of how much output is required for such an unknown attack, how can we have any trust in that statement?
Now that was putting it very black and white, and even accuses the author of incorrect statements. However, we have to consider all the statements made by the author of the algorithm to at least partially exonerate her:
I know that if I were trying to predict a random number generator, I'd want something easier than the PCG family. But if I wanted actual crypographic security for secure communication, I'd probably want to use something that has been around longer and seen more scrutiny.
Hopefully as time passes, the PCG generation scheme will receive scrutiny from people with far more expertise in crypographic security than me, and we will have a clearer picture about how easily it can be predicted. With that in mind, I hope to offer some crypographic secuity challenges in the future to encourage people to try to break it.
So please consider it insecure until analysis has shown otherwise, and maybe use a generator where the words "cryptographic" and "security" are spelled correctly, preferably with the word "analysis" attached to it...