Forward secrecy prevents observed output from revealing earlier values or previously used secret state. In a cryptographic pseudorandom number generator, an attacker who sees a later value should not be able to reconstruct the values produced before it. section 2.2.3
A predictable generator fails immediately: when its algorithm, constants, and current output are known, an attacker can clone the state to produce future values and reverse the recurrence to recover past values. Exposing internal state directly makes this failure especially clear. section 2.2.3
Recovering values from a predictable stream
Given the stream 1538354858, 90320905, 488601845, 1634248641, an attacker can seed a cloned LCG with 1634248641 to predict later values or rearrange its recurrence to calculate earlier ones. RC4-based Wi-Fi attacks go further: recovering the keystream can expose the original seed key, allowing encrypted traffic to be decrypted and violating forward secrecy. section 2.2.3 section 4.3
