I'm pretty sure most people have taken the certicom patent on using this technique for "escrow" as pretty strong evidence that it was an intentional backdoor.

I'm pretty sure most people have taken the certicom patent on using this technique for "escrow" as pretty strong evidence that it was an intentional backdoor. Esp. coupled with its insanely slow performance and NSA's failure to point out that the selection of the 'random' numbers could be used to backdoor the cryptosystem. (especially when they continued to fail to point that out and support the cryptosystem while embargoing the patent for national security reasons). But indeed, I'm not aware of any stronger proof. ... but people go to jail on evidence less circumstantial than this all the time. How high a bar must be set before we can just say "backdoored" without a page of footnotes?