I read about bactracking resistance:
Story (Motivational Story) in first paper is interesting. But seems to be theoretical.
Backtracking resistance is critical to applications requiring long-term security of past outputs.
Any examples? Is this useful in some key-agreement protocol? Do we use it somewhere? I know we use forward secrecy in some protocols:
But what with backward secrecy? Can it be alternative to public key cryptography as they wrote here:
Initially, they thought to use a public key encryption scheme but quickly got tired of the need to exchange their public keys so frequently. Then, Alice suggested they each use a cryptographically secure pseudorandom bit generator initialized with the same secret seed to generate the same key for a symmetric encryption algorithm. After exchanging the secret seed, Alice and Bob each used the pseudorandom bit generator on their respective computers and decided to generate a fresh AES  key every day.
If RSA will be broken by quantum computers, can this approach be some kind of solution?