Is a tree of CSPRNGs secure? Given two CSPRNGs $A$ and $B$ (of possibly the same family/algorithm), where $A$ is properly seeded from a high-entropy source, can $A$ be used to seed $B$ without compromising the security of either? Moreover, could a tree of such CSPRNGs rooted at $A$ be formed such that all generators can be used independently without revealing information about any other?
My loose attempt at proving this claim uses properties/assumptions gathered from here, here, and here:

Let $A$ be the root of a tree of CSPRNGs, each seeded by its parent. Assume that given the states of a subset of the non-root CSPRNGs, one can learn some secret property of one of the other non-root CSPRNGs not in the set.
Let $A'$ be an unknown source of randomness. By constructing a similar tree from its output and knowing the states of all non-root CSPRNGs, one can test for the above property to distinguish $A'$ from true randomness with non-negligible probability. This contradicts the indistinguishability of the CSPRNG, so it must be infeasible to find such a property.

Also (less rigorously):

Let $A$ be the root of a tree of CSPRNGs, each seeded by its parent. Assume that given the seeds and states of a subset of the non-root CSPRNGs, one can learn some secret piece of information about the root $A$. Then one can predict with non-negligible probability a bit of $A$'s past or future output other than the known seeds. This contradicts the security of the CSPRNG, so no such information can feasibly be obtained.

Together, these would mean that any CSPRNG in the tree is secure, needing only to trust the CSPRNGs in the path from it to the root.
Are these proofs and my conclusion correct for general CSPRNGs?

Note: A trivial counterexample for non-cryptographic PRNGs is the linear congruential generator, for which $A$ and $B$ would share identical states and produce identical results.
Yes, this is basically the Goldreich-Goldwasser-Micali construction of a PRF from a PRG. All leaves of the tree appear independently random, and furthermore the construction works even if the tree has exponentially many leaves (note that it is possible to compute the value at one leaf without computing the entire tree, by focusing just on the root-to-leaf path).

You can find a formal proof of security for this construction in section 6.3 of my book (PDF link).


  Goldreich, Oded, Shafi Goldwasser, and Silvio Micali. "How To Construct Random Functions." Foundations of Computer Science, 1984. 25th Annual Symposium on. IEEE, 1984.