Why are Fortuna entropy pools reset after a reseed? I've implemented LibTomCrypt's version of fortuna and am wondering about the pool resetting after a reseed. In fortuna.c in libtomcrypt we have the following (which is that part that adds the entropy from the pools into the key),

for (x = 0; x &lt; LTC_FORTUNA_POOLS; x++) {
  if (x == 0 || ((prng-&gt;fortuna.reset_cnt &gt;&gt; (x-1)) &amp; 1) == 0) { 
      /* terminate this hash */
      if ((err = sha256_done(&amp;prng-&gt;fortuna.pool[x], tmp)) != CRYPT_OK) {
         sha256_done(&amp;md, tmp);
         return err; 
      }
      /* add it to the string */
      if ((err = sha256_process(&amp;md, tmp, 32)) != CRYPT_OK) {
         sha256_done(&amp;md, tmp);
         return err;
      }
      /* reset this pool */
      if ((err = sha256_init(&amp;prng-&gt;fortuna.pool[x])) != CRYPT_OK) {
         sha256_done(&amp;md, tmp);
         return err;
      }
   } else {
      break;
   }
}


Once the pool has been added to the key, it is reset, why is that? I realise that at that point the entropy has been included in the key, so it has been used, but why not just keep adding entropy to the pool and have it keep all the entropy from the beginning of time? Is there any disadvantage if the pools are not reset?
If nothing else, it makes the output of the pool irrecoverable. One of Fortuna's goals is to make prior Fortuna outputs safe from a compromise (the discovery of all of Fortuna's current data by an adversary). If the pool continued on without a reset, with little or no entropy added before the compromise took place, the adversary could more easily calculate the past contents of the master pool.

Edit: Per M. Grieu (Merci!), let's make that "more easily verify guesses of past inputs to the master pool".

Also, I believe the OP's question is less about LibTomCrypt than about the Fortuna algorithm itself.