I've actually written an article about this for the Dutch website security.nl two weeks ago. Looking at the facts alone, I find it far-fetched but most certainl

I've actually written an article about this for the Dutch website security.nl two weeks ago. Looking at the facts alone, I find it far-fetched but most certainly feasible and it should be considered a possibility. So I disagree with anyone saying it's totally infeasible, but I'm skeptical about whether they really did go through the effort of doing this. Dutch article: https://www.security.nl/artikel/47135/1/De_onzichtbare_backdoor%3A_een_voorspelbare_PRNG_in_de_CPU.html https://www.security.nl/artikel/47135/1/De_onzichtbare_backd... English summary: Intel included a new CPU instruction called RdRand as of their Ivy Bridge architecture. This RdRand instruction produces random numbers generated by the chip itself. However the issue with this kind of random number generation, especially since Intel says it's cryptographically secure, is that it can not be audited or verified. Sure we can run statistical analysis on it, but we cannot tell the difference between true randomness and the output of AES-CBC. Nowadays the output is mixed with the existing entropy sources in Linux, but in closed source systems such as Windows and OS X we don't know how RdRand's output is used. I also mention the potential consequences of such a bug, which are rather wide-ranging. If RdRand's output is used directly then we can assume: if you have an Ivy Bridge CPU or newer, all your ssl/tls traffic can be decrypted (it needs randomness to setup a session). If the server that generated the private key was Ivy Bridge or newer, all traffic to and from that server can be forged. Furthermore, things like TCP sequence numbers or DNS source port numbers could be predicted, allowing offensive capabilities as well as passive cracking of our traffic. Again, I'm personally skeptical about all of this, but the potential consequences are quite bad, and it's not all that hard to hide their tracks... I can provide a theoretical proof of concept on demand. The only thing I have to guess at is whether the CPU can maintain a state between power cycles, that question is best left for others to answer. It would not have to be large though, a few bytes is all it takes.