I agree that the oracle of hindsight can often lead us astray.<p>However, in 2007, it wasn&#x27;t just known that you could implement a backdoor, but how to do so.  This of course means that any constants generated after this point could not be given the benefit of the doubt since anyone could launch this attack (and I think you&#x27;ll grant me that all major intelligence services knew how to create and use a similar backdoor after 2007).  And while USG did not acknowledge a backdoor, there was real, public doubt about the constants: Schneier&#x27;s article in Wired was titled (notwithstanding Betteridge) &quot;Did NSA put a Secret Backdoor in New Encryption Standard?&quot;<p>Those in the standard were of unknown status, but even 2007 Schneier had the appropriately conservative cryptographer response and recommended &quot;not to use Dual_EC_DRBG under any circumstances.&quot;<p>The pieces were there in 2012 for anyone that noticed a new Dual EC dependency being added, but I agree that the knowledge was not well-known enough (though it saddens me that a VPN manufacturer didn&#x27;t know to avoid it 5 years later).<p>I still hold to the statement that rekeying Dual EC in 2012 is not a smoking gun on the standard, but more suggestive of an opportunistic attacker using the known mechanism for how to embed such a backdoor.  If detected, it&#x27;s obvious it&#x27;s a backdoor, but that&#x27;s not an indictment on the standard&#x27;s constants (in fact, if you could otherwise attribute the attack to NSA, it&#x27;s a tiny bit of evidence that either there is no standard backdoor or that USG don&#x27;t want to use it in this case).<p>Here&#x27;s a statement that I think we might disagree on: I believe that no one in 2012 that knew why the provenance of the constants could be a problem would have allowed Dual EC in the codebase in any form.  This is why I believe the incremental chance of detection from changing the constants was small and why it&#x27;d be worth it to avoid attribution.<p>That said, I&#x27;ve stated my positions and see no need to continuing pressing legitimate points of disagreement.  I just wanted to understand your position.