I want to construct a hash-chain where I want to share millions of small AES-128 keys with Bob over a period of time. Bob should not be able to predict the future keys if he knows the past keys. I also want to avoid having Bob storing all these keys, but rather be able to derive them so that if they know the key from time $t$, they should be able to derive the keys from time $t-1, t-2$, and so on. So, future-to-past derivation should be possible. Past-to-future derivation should be hard.
The hash-chain way of doing this is to start with a random string, hash it with sha256, say, 1 million times, and start the chain with the 1 millionth hash. This way, if Bob is at the 10th iteration of our protocol, and wants to go back to the 6th iteration, he hashes the 10th iteration key 4 times to get the 6th key.
I am wondering if we can do the same with some encryption scheme like RSA. I give Bob my RSA public key $([e, n])$. I start the chain with a large random number in the range $(2, n-1)$, and decrypt it. I am assuming that every number in this range has a valid decryption. This decryption chain can continue as many times. If Bob wants to reconstruct keys, he uses the encryption algorithm, for which he has the public key. I can use some KDF to derive the AES-128 key from this large RSA "number".
Is the RSA-chain scheme as safe as the SHA-chain scheme?