On Backtracking Resistance in Pseudorandom Bit Generation∗

An incremental pseudorandom bit generator (iPRBG) is backtracking resistant if a state compromise does not allow the attacker a non-negligible advantage at distinguishing previouslygenerated bits from uniformly distributed random bits. Backtracking resistance can provide increased security in cryptographic protocols with long-term secrecy requirements. While a necessary condition for an iPRBG to be backtracking resistant is that the next-state function be one-way, we show that this condition is not sufficient. To do this, we assume that an iPRBG based on a one-way next-state permutation exists. We convert such an iPRBG into a new iPRBG that generates the same output sequence and is also based on a one-way next-state permutation, but the new generator is provably not backtracking resistant. We leave open the important question of whether cryptographically secure backtracking resistant iPRBGs exist, even assuming that cryptographically strong PRBGs and one-way permutations exist.