# How can two parties offline generate a sequence of corresponding key pairs that are still sufficiently random

I'm looking to design a protocol between two parties A and B to generate sequence of RSA private keys $$p_{a_0}, p_{a_1}, ... p_{a_k}$$ and a sequence of corresponding RSA public keys $$P_{b_0}, P_{b_1} ... P_{b_k}$$.

with the property that $$P_{b_k}$$ is the corresponding public key of private key $$p_{a_k}$$. But there is a twist:

$$A,B$$ will share an initial secret. After this point $$A$$ will generate its private keys ,and $$B$$ will generate JUST the public keys and $$B$$ should have NO way of knowing what $$A's$$ private keys are. So $$B$$ should be able to offline generate public keys without knowing what they're private keys are but the protocol should ensure that $$A$$ ends up with correspoing private keys to $$B$$'s public key sequence.

The use case is in an "eventually-compromised" system that is $$A,B$$ initially can share information freely but at some point their computers/networks become infected at which point they shut down and operate in a purely offline manner for a while. During this time I want them to be able to create documents/digitally sign/verify digital signatures of each other despite the inability to communicate and possibility of discovering that some of their keys have been compromised.

A generates a key-pair, $$p_0, P_0$$. A and B share a secret $$s$$ and the public key $$P_0$$. To move to the next key-pair, A multiplies the private key by $$s$$ and B multiplies the public key by $$s$$, so that the key-pair is $$p_n = s^np_0, P_n = s^nP_0$$ at step $$n$$.