Did NSA Put a Secret Backdoor in New Encryption Standard? (2007)
Back when DES was being designed, IBM had a bunch of values in their S-boxes. NSA told them "don't use those values; use these values instead."  People freaked that it was a backdoor the NSA put in.<p>About 15 years later, differential cryptoanalysis was publicly discovered. The original S-box values would have been very vulnerable to the attack, but the ones the NSA used were resistant, suggesting that NSA knew about differential cryptoanalysis way ahead of time and were suggesting ways to protect the public against its eventual discovery.<p>It is <i>possible</i> that there is still some magic in there to let the NSA magically defeat DES, but we still haven't found it. Similarly, it's <i>possible</i> that this random number generator exists for some nefarious purpose, but we have no evidence for it.<p>Also, this article is 5 years old (the headline didn't say so when I first read this). Schneier was in pretty big self-promotion mode at that time.