I am surprised people cared about Dual EC in 2014 -- it was considered dangerous back in 2007[0], and in 2013, NIST recommended against using it ([1], pdf) Btw

I am surprised people cared about Dual EC in 2014 -- it was considered dangerous back in 2007[0], and in 2013, NIST recommended against using it ([1], pdf) Btw, for those who have not seen it, there is a nice story about OpenSSL devs who both had to implemented DualEC for certification, and knew the algorithm was bad and should not have been used. As a result, the implementation was produced, but had a fatal bug which prevented it from being used outside of testing [2]. [0] https://www.wired.com/2007/11/securitymatters-1115/ https://www.wired.com/2007/11/securitymatters-1115/ [1] http://csrc.nist.gov/publications/nistbul/itlbul2013_09_supplemental.pdf http://csrc.nist.gov/publications/nistbul/itlbul2013_09_supp... [2] https://lwn.net/Articles/578375/ https://lwn.net/Articles/578375/