A modification of the Blum-Micalli construction
Discuss the advantages/disadvantages of outputting also $f^l(x)$.
  


Knowledge of the trapdoor secret would allow the receiver of a message encrypted with the  pseudo random one time pad to recover the seed $x$ if one block of the generator output would be xored with a fixed value known to both the sender and receiver.

This would allow to encrypt more than one message by using a random seed for each message. If the seed could not be recovered from the ciphertext then sender and receiver had to securely exchange random seed values for each message in order to avoid using the same pseudo random one time pad twice.