Does a regularly reseeded PRNG provide backtracking resistance? I'm currently discussing a security topic with some of my classmates.

A cryptographic PRNG typically provides backtracking resistance if an adversary that compromises the internal PRNG state cannot distinguish previously generated values from random values. 

Let's assume I use an invertible PRF as PRNG (e.g. AES in CTR mode with a true random key). Then this in general does not provide backtracking resistance since, after obtaining the internal state, I can calculate the previous output using the inverted PRF. 

Now let's assume that I regularly reseed my PRNG, like for example every second. Does it then provide backtracking resistance or not?

We have now two opinions:


The PRNG does not provide backtracking resistance since it is possible to recover previous values within the compromised reseed interval.
The PRNG provides backtracking resistance since values beyond the reseed interval can only be guessed with negligible probability


Can someone explain who is right and why?

Best regards,
Matt
Here's a perhaps better way to frame it that won't lead to tedious semantic disputes:


Consider a PRNG with 256-bit seed $s$ that, on each request, produces $\operatorname{AES}_s(2) \mathbin\| \operatorname{AES}_s(3) \mathbin\| \cdots$ as output, and updates its seed by $s' = \operatorname{AES}_s(0) \mathbin\| \operatorname{AES}_s(1)$.  This PRNG erases its key after every request.
Consider a PRNG with 256-bit seed $s$ that, on each request, produces $\operatorname{AES}_s(0) \mathbin\| \operatorname{AES}_s(1) \mathbin\| \operatorname{AES}_s(2) \cdots$ as output.  If you schedule a timer event to reseed it every second, then this PRNG erases its key after every second.

Of course, in this case, you need some source from which to reseed it, so the story doesn't end here and is necessarily more complicated than the story in (1) for prompt key erasure.


The terms backtracking resistance and forward secrecy are not as helpful because they don't emphasize when the keys are erased.  Both PRNGs could be construed to provide backtracking resistance in some sense, but PRNG (1) is largely a better engineering choice than PRNG (2) because it doesn't need reseeding at all (so fewer things to wire up, fewer things that can go wrong) and it provides even prompter key erasure.

The question, as stated, is essentially about PRNG (2):


  We have now two opinions:
  
  
  The PRNG does not provide backtracking resistance since it is possible to recover previous values within the compromised reseed interval.
  The PRNG provides backtracking resistance since values beyond the reseed interval can only be guessed with negligible probability
  
  
  Can someone explain who is right and why?


You're both right: it provides backtracking resistance every second, but not every request, so there is a window of time in which state compromise could reveal future outputs, but it's small.  It's arguable, not a priori clear, which of these ‘backtracking resistance’ means, which is why I recommend emphasizing when keys are erased.