Certicom did the same thing. The argument given was that these companies have less access to data interception, therefore the impact of a maliciously-generated

Certicom did the same thing. The argument given was that these companies have less access to data interception, therefore the impact of a maliciously-generated set of parameters is lower. That's absolutely crazy. The real danger of including Dual EC in any system is the risk that it adds to code. Now instead of having to include a large, easy-to-detect passive decryption backdoor, an attacker only has to change a few bytes. Sometimes just a pointer value. Once you do that, Dual EC is often ridiculously easy to attack: http://dualec.org/DualECTLS.pdf http://dualec.org/DualECTLS.pdf