Asymmetric CSPRNG where the public key only works backward Is there an asymmetric cryptographically secure pseudo random number generator in which the public key only goes backward? For example, I'd like to generate 5,000 digits, then provide the public key and RNG state to another party. Then they'd generate the same digits backward from 5,000 to 1. The second party should not be able to calculate the digits from 5,001 onward.

Edit: Here's a working demo of DannyNiu's RSA approach.
Disclaimer: I've not verified the security of my proposal. 

You can achieve that in two ways: one pre-quantum, using RSA-like scheme, another post-quantum, using multivariate system. 


The RSA version. 


Generate an RSA key pair, keep the private key $(N,d)$ to yourself, give the public key $(N,e)$ to the second party. 

To generating new numbers, calculate $x_{i+1} = x_i^d \pmod N$. This way, the second party can go backwards from known $x_i$ by calculating $x_{i-1} = x_i^e \pmod N$


The multivariate version. 


This version is significantly more heavy-weight than the RSA version. Although there are several multivariate signature schemes in the NIST PQC "Competition" (it seems difficult to build secure encryption scheme using MV), many of them uses exotic methods to compress the public key, which may be optional depending on your use-case. 

In its simple form, you have a public multivariate system $P$ which is the composition of private components $S \circ F \circ T$ where $F$ is a easily solvable quadratic system, and $S$ and $T$ are linear. 

To generate new random numbers, 


Calculate $u = S^{-1}(x_i)$
Solve $u = F(v)$ and choose arbitrary $v$
Calculate $x_{i+1} = T^{-1}(v)$


The second party can reverse it with $x_{i-1} = P(x_i)$

As mentioned by poncho in the comment, the solved $v$ may not be a unique solution, but that's not a problem because any generated $x_{i+1}$ satisfies $x_i = P(x_{i+1})$. 

Edit

It seems you're not quite familiar with the notations. 

In $x_{i\pm1}$, the $i\pm1$ is the subscript, so in terms familiar to programmers, it's x[i+1] or x[i-1]. 

$x_i$ is the current state of the PRNG. Since that is the output of some arithmetic operations, its bit pattern is not fully uniformly random (i.e. may fail some sophisticated statistic tests), so you may need to truncate it and/or hash it, to obtain some quality random bits - hashing is also done by the TLS protocol for the same reason. 

And yes, it's an iterative generator, but I'm not sure what you mean by "algebraic", and why you believe it'd be inefficient in the second comment.