If a PRG is constructed by iterating a PRF, is it backtracking-resistant?

Question

Say we construct a pseudo-random generator from a pseudo-random function $f$ (using some constant key $k$ and some initial value $v_0$). We do this by feeding the output block of the PRF back into the PRF to produce a new block of pseudo-random bits. That is, $B_{i+1} = f_k(B_i)$. Is that backtracking-resistant?

I thought it would be backtracking resistant because if we compromise the internal state of the PRG at time $t+1$ (meaning the adversary gets $k$ and $B_{i+1}$), then we can't find any of the previous blocks $B_i$ (for $i < t+1$), since the PRF is hard to invert. That is, $B_{i+1} = f_k(B_i)$, so we want to find $B_i$ by doing $B_i = f^{-1}_k(B_{i+1})$, but we can't invert it.

Am I missing something? Apparently it's not backtracking-resistant because the key isn't being changed, whereas other PRGs such as HMAC-DRBG are, because they update the key.

I might have mixed up PRF with one-way function (I don't quite understand the relationship between them). — user29077, Nov 14 '15 at 04:40
A PRF with large domain is hard to invert for parties/people who don't know the key. — , Nov 14 '15 at 04:41
A PRF may also be hard to invert for someone who knows the key, as there is no requirement for an efficient inverting algorithm. However, since a PRF is normally constructed from a PRG, I don't see the point of doing it the other way... — fkraiem, Nov 14 '15 at 04:47
Could you give an example of a PRF that is hard to invert for someone who doesn't know the key, but easy to invert for someone who knows the key? — user29077, Nov 14 '15 at 04:58
Yes. $:$ https://en.wikipedia.org/wiki/Advanced_Encryption_Standard $;;;;$ — , Nov 14 '15 at 05:20
I like this description: A Pseudo Random Function is a function that is indistinguishable from a function selected at random from the set of all functions with the same domain and value set. Besides that, I wouldn’t have pointed to Wikipedia, but rather… How to construct a good PRF from a block cipher? — e-sushi, Nov 14 '15 at 20:53

score 1 · Answer 1 · answered Jul 05 '16 at 08:28

Is that backtracking-resistant?

No, as mentioned in the comments, if the PRF itself can be inverted when you know the key, the PRG is not backtracking resistant.

I thought it would be backtracking resistant because if we compromise the internal state of the PRG at time $t+1$ (meaning the adversary gets $k$ and $B_{i+1}$), then we can't find any of the previous blocks $B_i$ (for $i < t+1$), since the PRF is hard to invert.

Being hard to invert when the key is known is not a required property of a PRF and many practical PRF constructions (like block ciphers) lack it.

Apparently it's not backtracking-resistant because the key isn't being changed, whereas other PRGs such as HMAC-DRBG are, because they update the key.

Indeed. If you overwrite the key with data generated using the old key, there is no way to backtrack unless the PRF is invertible (to state and key) by those without the (old) key.

If a PRG is constructed by iterating a PRF, is it backtracking-resistant?

1 Answers1