Backward secrecy

As explained in Hacking Cryptography

The property of a pseudorandom generator that prevents an observer of current output from predicting values generated later.

Backward secrecy prevents an observer who sees current pseudorandom output from predicting values generated later. It is a required property of a cryptographically secure pseudorandom number generator. section 2.2.3

Predicting future output from an LCG

An attacker who knows the linear congruential generator, its constants, and the current output 1634248641 can seed an identical LCG clone and generate subsequent values. Because the generator exposes its internal state directly as output, observing one value reveals the state needed to continue the sequence. section 2.2.3

A defensive design separates internal state from emitted output with a transformation that is hard to reverse. This prevents an observed value from immediately revealing the state used to produce later values. section 2.2.3

Figure 2.10 Some PRNGs transform the state before outputting it as the next value.

Use the state-to-output diagram to compare direct state exposure with transformed output. section 2.2.3

How Hacking Cryptography covers it

How deep it goes

Traces an LCG prediction attack from known output and state exposure to a hard-to-reverse output transformation.

Examples

Uses the output sequence 1538354858, 90320905, 488601845, and 1634248641 to illustrate prediction.

What it assumes

Assumes familiarity with PRNG state and LCG operation while contrasting them with cryptographically secure generation.

What you can do after

Diagnose future-output prediction when a PRNG exposes internal state directly through its output.

How it connects

Connects PRNGs, CSPRNGs, internal state, LCGs, and forward secrecy.

liveBookmanning.com

Read Hacking Cryptography on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Hacking Cryptography. The section links point to the parts of the book it draws on.