Dual EC specifies two standard curve points. The "kleptographic" back door is the relationship between them, i.e. the knowledge of d in the equation P = dQ. Thi

Dual EC specifies two standard curve points. The "kleptographic" back door is the relationship between them, i.e. the knowledge of d in the equation P = dQ. This hidden relationship was apparent to cryptographers pretty quickly, see http://rump2007.cr.yp.to/15-shumow.pdf http://rump2007.cr.yp.to/15-shumow.pdf. What would it mean for a curve to have a "kleptographic" back door? Only one base point P is defined in the curve parameters, so there is no hidden relationship to take advantage of. It is possible there are weaknesses in the NIST curves, but if so: 1. They must lie in the curve parameters themselves, i.e. something anyone could conceivably discover. 2. They must rely on a significant advance in ECDLP, e.g. a new class of weak curve.