I absolutely assume that if the backdoor was placed by a vendor, they would make sure it was a one-way function.<p>I (perhaps incorrectly) assumed that criminals would want to stick in a hash function, given a choice.<p>I think the explanation, that adding a hash function will attract more attention than a simple strcmp is a good one.  As is the desire to stick in something that gets by code review.<p>All signs point to this 100% not being Juniper engineering officially adding a back door, and it being a party doing it without authorization.