This is disingenuous. RSA used it as a default in a commercial crypto library, as you must know. End users won't generally be aware that it's being used in a pr

This is disingenuous. RSA used it as a default in a commercial crypto library, as you must know. End users won't generally be aware that it's being used in a product, but that doesn't mean it isn't out there. It is unlikely that most developers changed the default unless it was having a noticeable impact on performance, which wouldn't be the case if it was just used for key generation. http://www.wired.com/threatlevel/2013/09/rsa-advisory-nsa-algorithm/ http://www.wired.com/threatlevel/2013/09/rsa-advisory-nsa-al... > In its advisory, RSA said that all versions of RSA BSAFE Toolkits, including all versions of Crypto-C ME, Micro Edition Suite, Crypto-J, Cert-J, SSL-J, Crypto-C, Cert-C, SSL-C were affected. > In addition, all versions of RSA Data Protection Manager (DPM) server and clients were affected as well. > “Every product that we as RSA make, if it has a crypto function, we may or may not ourselves have decided to use this algorithm,” said Sam Curry, chief technical officer for RSA Security. “So we’re also going to go through and make sure that we ourselves follow our own advice and aren’t using this algorithm.” Here's someone who has dug up a decent amount of real-world products: http://security.stackexchange.com/questions/43164/which-products-are-affected-by-nsas-ability-to-crack-pseudo-random-number-gener http://security.stackexchange.com/questions/43164/which-prod...