# Forward Security of Symmetric Encryption Schemes with LFSR based PRNG

Forward security can be achieved using symmetric encryption schemes by combining with a pseudo-random number generator (PRNG). Does LFSR based PRNG provide forward security in this case?

• The claim "Forward security can be achieved using symmetric encryption schemes" is dubious and unsourced Also, "LFSR-based PRNG" is vague. It goes from LFSR (very insecure) to Trivium (unbroken), with ASG, SSG, A5/1 in-between (unbroken for large-enough parameters, with no precise security claim). – fgrieu Feb 10 at 8:36

Once an attacker knows $$2L$$-bits of an $$LFSR$$ of length $$L$$ with unknown taps, they can use the Berlekamp-Massey algorithm to construct your LFSR. If the taps are known, then only $$L$$ bits are required. Therefore your PRNG based on a single LFSR will fail. They were popular but anymore.