Because the standard committee were aware of the potential for a backdoor, a way for an implementer to choose their own secure "P" and "Q" were included. But the exact formulation in the standard was written such that use of the alleged backdoored "P" and "Q" was required for FIPS 140-2 validation, so the OpenSSL project chose to implement the backdoored "P" and "Q", even though they were aware of the potential backdoor and would have preferred generating their own secure "P" and "Q". New York Times would later write that NSA had worked during the standardization process to eventually become the sole editor of the standard. A security proof was later published for Dual_EC_DRBG by Daniel R.L. Brown and Kristian Gjøsteen, showing that the generated elliptic curve points would be indistinguishable from uniformly random elliptic curve points, and that if fewer bits were output in the final output truncation, and if the two elliptic curve points "P" and "Q" were independent, then Dual_EC_DRBG is secure. The proof relied on the assumption that three problems were hard: the "decisional Diffie–Hellman assumption" (which is generally accepted to be hard), and two newer less-known problems which are not generally accepted to be hard: the "truncated point problem", and the "x-logarithm problem". Dual_EC_DRBG was quite slow compared to many alternative CSPRNGs (which don't have security reductions), but Daniel R.L. Brown argues that the security reduction makes the slow Dual_EC_DRBG a valid alternative (assuming implementors disable the obvious backdoor). Note that Daniel R.L. Brown works for Certicom, the main owner of elliptic curve cryptography patents, so there may be a conflict of interest in promoting an EC CSPRNG. The alleged NSA backdoor would allow the attacker to determine the internal state of the random number generator from looking at the output from a single round (32 bytes); all future output of the random number generator can then easily be calculated, until the CSPRNG is reseeded with an external source of randomness. This makes for example SSL/TLS vulnerable, since the setup of a TLS connection includes the sending of a randomly generated cryptographic nonce in the clear. NSA's alleged backdoor would depend on their knowing of the single "e" such that formula_1. This is a hard problem if "P" and "Q" are set ahead of time, but it's easier if "P" and "Q" are chosen. "e" is a secret key presumably known only by NSA, and the alleged backdoor is a kleptographic asymmetric hidden backdoor.