To be fair, Dual_EC being backdoored was never "far-fetched". It's been blatantly obvious since 2004, but few people noticed. Here is a NIST email from 2004 ac

To be fair, Dual_EC being backdoored was never "far-fetched". It's been blatantly obvious since 2004, but few people noticed. Here is a NIST email from 2004 acknowledging that the NSA classified how the Q and P parameters were generated: http://1.bp.blogspot.com/-ax86n-7Rb9U/VLa_Z_iC0WI/AAAAAAAABPA/zvcJGzCeTng/s1600/kelseyemail.png http://1.bp.blogspot.com/-ax86n-7Rb9U/VLa_Z_iC0WI/AAAAAAAABP... With this, it's completely absurd to imagine that NSA cryptographers did not discover this possible backdoor, when they were explicitly aware of the relationship of knowing Q and P and knowing the state of the RNG. Even assuming that the NSA cryptographers were incompetent and did not discover it before the public researchers and classified it for no reason, their continued endorsement for Dual_EC and their $10 million payments to RSA for making Dual_EC the default RNG paints a clear picture that -- yes, it's backdoored, and the NSA intentionally endorsed bad crypto to American companies. It should also be noted that the NSA's public comments does not deny that the put in a backdoor. "The non-denial denial". And this is not counting the beyond-any-doubt evidence from Snowden that, Dual_EC was concretely part of BULLRUN.