Tag Info

Is that backtracking-resistant? No, as mentioned in the comments, if the PRF itself can be inverted when you know the key, the PRG is not backtracking resistant. I thought it would be backtracking resistant because if we compromise the internal state of the PRG at time $t+1$ (meaning the adversary gets $k$ and $B_{i+1}$), then we can't find any of the ...