So, if we assume this is indeed a backdoored Dual_EC PKRNG - how are those typically initialized? Are we looking at something equivalent to the Debian ssh&#x2F;ssl bug, where we have some millions of &quot;known bad keys&quot;, or is it more likely each case is different (ie some knowledge of the state is needed for a useful attack)?<p>Does anyone have a pointer to a proof-of-concept &quot;evil&quot;  (or &quot;escrow-enabled&quot;) system based around such an RNG?