So is there any plausible reason for using Dual_EC besides &quot;the NSA is paying us off&quot; and &quot;we heard its security is based on the ECDLP so it maybe is harder to break&quot;? From what I understand, it&#x27;s slower and gives poorer randomness than most other well-established CSPRNGs.<p>Because, from here, it looks an awful lot like Juniper put their own backdoor in, and the hacker just changed it to let them use it instead. The use of Dual_EC alone, maybe, could be overlooked... but with an implementation bug that just so happens to reveal Dual_EC output directly... something&#x27;s fishy.