There is some weak reasoning with Dual_EC_DRBG ... ignoring the possibility of power/timing/etc. side-channels, Dual_EC_DRBG is as provably difficult to break a

There is some weak reasoning with Dual_EC_DRBG ... ignoring the possibility of power/timing/etc. side-channels, Dual_EC_DRBG is as provably difficult to break as Elliptic Curve Diffie-Hellman and at least as strong as ECDSA using the same curve. If your system is already broken if the attacker can compute discrete logs over that particular elliptic curve, and you trust that the NSA didn't generate the two constants in Dual_EC_DRBG such that they know the scalar to multiply the one by to get the other... then using Dual_EC_DRBG doesn't introduce extra attack surface, while using another PRNG does introduce extra attack surface. Now, that's weak reasoning, particularly since they only dropped 16 bits when outputting values where it seems much safer to drop half the bits when outputting a value. However, there is a narrow set of circumstances where Dual_EC_DRBG makes sense. Also, if you're using ECDH for encryption, you're almost certainly using AES in counter mode or ChaCha20. In that case, you're best off using a PRNG based on AES in counter mode or ChaCha20, using an entropy-gathering seeding algorithm that gracefully recovers from state compromise (such as Fortuna).