Forward security can be achieved using symmetric encryption schemes by combining with a pseudo-random number generator (PRNG). Does LFSR based PRNG provide forward security in this case?
Once an attacker knows $2L$-bits of an $LFSR$ of length $L$ with unknown taps, they can use the Berlekamp-Massey algorithm to construct your LFSR. If the taps are known, then only $L$ bits are required. Therefore your PRNG based on a single LFSR will fail. They were popular but anymore.
- LFSR's has no next-bit security. From previous known states, the next bit is exactly can be found.
- More generally, an attacker that knows the current state, they have more power than predicting the next outputs, they know the next states of your random number generator.
- LFSR's can be run backward, which will reveal the previously generated random numbers. Once an attacker accesses the system, they will able to decrypt the previously encrypted messages. See the Double ratchet which is used by Signal.