[healsjnr1]

I've got some direct personal experience in this one. A few key points from how I saw it play out inside:

- there was a lot of noise made about this by the bsafe crypto team when it was first implemented (anecdotal, but I trust the people that were there and the context below helps reinforce this). From what I heard there was clear communication that adding EC drbg to the toolkits the way nsa wanted was insecure.

- that happened before my time, but by the time I got there it was kind of an inside joke that EC drbg was an NSA backdoor (I think this was around 2010)

- the above was tempered by the fact that it was so horrendously slow, no one could imagine it being used

- even though RSA demanded it was the default RNG for the toolkit, the first part of documentation strongly suggested changing this default

- my memory is that this work on EC drbg funded development bsafe SSL toolkits. So while the money may have been relatively small, it opened up a new product for BSAFE

The smoking gun and the bit that made it really obvious that something was off about this came in its use as part of the TLS toolkits.

There was an explicit, but unexplained, requirement that the _first 20 bytes_ of random generated during the handshake were sent unencrypted as part of the handshake.

EAY led that crypto team, they knew their stuff and they knew that this was off and there was no legitimate reason for doing this.

My take: this team new what was happening and they made it clear to management. As a really the people who made the decision to take NSA money knew what it was and the implication and went ahead anyway.

As a foot note, when we did the cleanup on this we found that in some of the toolkits the way that the 20bytes was sent was flawed and would have meant that an attempted backdoor using this would have failed. Whether this was intentionally or not _shrug_.

[tptacek]

This is great.

Just to be clear: the TLS integration and 20 bytes of random stuff was definitely a smoking gun; nobody thinks anything but that Dual EC is a backdoor after learning about it.

EAY is Eric A. Young? I didn't realize he'd worked on BSafe.