That's one of them, and the least interesting of both. I remember that the other one was way more concealed and involved a global variable or something like tha

That's one of them, and the least interesting of both. I remember that the other one was way more concealed and involved a global variable or something like that and it didn't seemed that the code was doing what was actually doing. There was an amazing blog entry which explained it, but can't find it right now. Edit: I don't think this was the one I read, but it's similar. https://cryptologie.net/article/316/junipers-backdoor/ https://cryptologie.net/article/316/junipers-backdoor/ Basically, Dual EC was chained to another PRNG, so the output should have been robust to crypto vulnerabilities discovered in any of both. The thing is: the second one was never called, because the for's index(a global variable) was set to 32 inside a function call, so the loop never run.