One of the authors of that duealec paper had this to say [1]: >Our results <dualec.org> say nothing about whether NIST, the NSA, or anyone else inserted a back

One of the authors of that duealec paper had this to say [1]: >Our results <dualec.org> say nothing about whether NIST, the NSA, or anyone else inserted a backdoor into dual ec. Instead, they say that if you know the relationship between P and Q, then some TLS implementations can be broken at a given cost. The precise results are more nuanced than that. You can read the website for a summary or the paper for the details. [1]http://www.ietf.org/mail-archive/web/tls/current/msg11730.html http://www.ietf.org/mail-archive/web/tls/current/msg11730.ht...