> or by imposing that condition in government contracts Not just government contracts. The intelligence community extensively partners with corporations. If

> or by imposing that condition in government contracts Not just government contracts. The intelligence community extensively partners with corporations. If I had to take a bet I wouldn't be surprised if the customer that demanded this wasn't the government, but was one of these partners. A minor nit: > is not “suspicious” as a choice of random generator, it’s stupid. I don't think this is completely fair. The security of dual ec is related (though not quite reducible) to the hardness of elliptic curve discrete log in the relevant group. If it weren't unreasonably slow I think a lot of people would be inclined to adopt a well reviewed and standardized RNG for their ECC-crypto system that itself had security traceable to ECC: if the DL assumption in that group is broken, then the connections are already insecure. Overstating the arguments against dual_ec weakens our security, rather than strengthening it because it obscures how reasonable people would go along with such proposals and undermines how critical it is that our standards receive adequate public review.