&gt; This backdoor appears to swap out the public key, which is something NSA has no interest in doing.<p>While they wouldn&#x27;t need to swap it out (since they can unlock standard Dual EC), that doesn&#x27;t mean they wouldn&#x27;t.<p>Assuming 1) that Dual EC was used here and 2) was inserted surreptitiously in a way that has a nonnegligible chance of discovery, it would make sense to rekey it since failing to do so would strongly attribute the attack to NSA (or someone willing to give up the passive backdoor opportunity in order to pin it on NSA).<p>The only case for NSA where using the old key would be best is if the use of standards-based Dual EC would pass scrutiny but a modified one would not.  This depends on the details.<p>If switching Juniper to Dual EC required only calling a different function in Juniper&#x27;s existing crypto library and&#x2F;or detection was unlikely, standard Dual EC might be best.  If the compromise added a full Dual EC implementation, then changing the constants is good (different magic constants don&#x27;t significantly increase risk of detection for the large inserted code blob while significantly decreasing the risk of attribution).