The auditors did only this: - ran the RNG through statistical tests (which of course passed flawlessly) - audited the source code (but the backdoor was in bin

The auditors did only this: - ran the RNG through statistical tests (which of course passed flawlessly) - audited the source code (but the backdoor was in binaries…) Source: DEFCON presentation linked elsewhere in comments.