A value produced by a non-cryptographic pseudo-random generator never throws, never looks wrong, and passes every test. Suppose someone recovers that generator's internal state from a handful of observed outputs: what do they gain, and in particular what happens to the values the system issued *before* the compromise? Then rank the controls that prevent this class of defect rather than detect it afterwards, and say why each rung is weaker than the one above it.

## The defect that never announces itself Most bug classes are self-reporting: a bad parse throws, a broken query errors, a failed authorisation check returns 403. Weak randomness reports nothing. The identifiers are unique, the tests pass, the users log in, and the only difference between a secure system and a broken one lives in the head of someone who has collected a few outputs. That asymmetry — invisible from the inside, cheap from the outside — is why this class needs a stated threat model and structural prevention rather than reviewer vigilance. ## What a recovered state yields, in both directions Ordinary generators are built for speed and reproducibility, not secrecy, and both properties come from the same design choice: a simple, fully invertible state update. A linear congruential generator's step is an affine map on a fixed-width integer and can be solved for its parameters and run backwards. A Mersenne Twister's output tempering is invertible and its recurrence is a linear map over bits, so roughly 624 consecutive 32-bit outputs reconstruct the state exactly — and that state can be stepped backwards as easily as forwards. The evidence differs by algorithm; the claim it supports is tier-level and holds for all of them: **an ordinary generator's sequence is a function of a small state, and knowing the state at any moment gives you the entire sequence in both time directions.** So the gain is not "the attacker can guess the next token." It is: from values they legitimately caused to be issued to themselves — register a few accounts, trigger their own password resets, open a few sessions — they compute the values issued to *everyone else*, including everyone served before they arrived. ## Backtracking is the axis that makes this class different Almost every other defect in this area has a damage window that opens when the attacker starts attacking. Here it opens when the code was deployed. This is precisely the property cryptographic generator designs are specified to provide and ordinary ones are not: **backtracking resistance** — compromising the current state must not reveal any previously produced output. It is bought with a one-way state update, so the state cannot be rewound. (The mirror property, protecting *future* output after a state compromise, is a different guarantee and needs fresh entropy mixed back in; it is not what is at stake here.) The operational consequences follow directly: - **Incident scope is historical, not current.** "When did the attacker first probe us?" is the wrong question. Every value of this kind ever issued must be treated as known. - **Rotation is the only remedy, and it works only for values that can be rotated.** Invalidating live sessions is easy; a key that already encrypted stored or exfiltrated data cannot be un-used, because ciphertext an attacker captured last year is decrypted with the key you now know was guessable. - **Absence of evidence is expected.** There is no failed-attempt trail, because a derived value is correct on the first try. ## Ranking exposure across a codebase Use the same reachability × privilege × data-sensitivity rubric that ranks any defect class across a codebase, and add the one axis specific to randomness: **reversibility** — a short-lived session id expires and rotates itself, whereas a long-lived signing key, a device credential burned at provisioning, or a key over data at rest cannot be undone, so it outranks a more reachable but self-expiring value. ## The control ladder, and why each rung holds The ordering is the standard one, weakening from guarantee to heuristic: **1. Structural separation — a guarantee.** Security-relevant values are minted only by a single audited facility that draws from the platform's cryptographic source, and the fast generator is not reachable from that path at all. This is the top rung because it removes the possibility rather than reducing the frequency; a call site cannot make the mistake if the weak source is not in scope. It also concentrates entropy budget, bias handling and encoding in one reviewed place. **2. Closed-world enumeration, where separation is impossible.** You often cannot ban the fast generator outright — simulation, sampling, jitter and load shaping legitimately want it. The replacement top rung is an explicitly enumerated, finite list of approved sources and approved call sites. It beats any open-world rule ("don't use anything that looks unsafe") for the same reason enumeration always does: an open-world pattern still admits every case nobody thought of, while a finite list is owned by the code and reviewed whenever it changes. **3. Transformation — and why it sits below enumeration.** Hashing, encoding or stretching a weak draw. This rung is genuinely weak and must be named as such: **the transformation is applied to the output, but the attacker attacks the input.** If the state has, say, a few billion reachable values, hashing each one costs the attacker one extra hash per candidate; the search space is exactly as large as it was. Transformation makes the value look different, never less predictable. It ranks below enumeration because enumeration can still eliminate the weak source entirely, whereas transformation concedes the weak source and merely reshapes its output. **4. Validation — heuristic.** Lint rules flagging non-cryptographic generator use, review checklists, build-time checks. Cheap and worth having, but they catch known spellings, miss library code that draws weakly three layers down, and cannot see how something was seeded. **5. Detection — the bottom, by construction.** Rate limits on token redemption, anomaly alerts, canary values. These fire when someone is *guessing*; against an attacker who has solved for the state, nothing anomalous happens, because the first attempt succeeds. ## Answering the question Lead with backtracking — that a recovered state exposes past issuance is the claim that distinguishes this class. Then give the ladder with a reason for at least one adjacent pair (post-hashing below enumeration is the sharpest one). Close on the practical consequence: because the window opens at deployment and detection cannot see it, the only acceptable answer is structural.