Was that part of the acquisition of NetScreen in <i>2004</i>? Juniper acquired NetScreen in February...but Dual EC wasn&#x27;t published as a draft until June of that year. This is new code.<p>Even if it weren&#x27;t, why would it be reasonable to allow critical cryptographic components to go unaudited for <i>8 years</i>? If the analysis so far is correct, then a <i>single</i> independent test vector for the RNG should have caught this bug. One. Lousy. Test. Furthermore, the fact they discussed their use of DualEC in 2013, and then claimed their construct was secure, is proof they were aware of the danger and yet, apparently, they hadn&#x27;t done anything to verify this.<p>Hanlon&#x27;s razor is going to condemn them one way or another here. Unless they can demonstrate extraordinary circumstances, then Juniper security products should be considered toxic.