The fact that you <i>could</i> use Dual EC to implement a backdoor was known in 2007, but it wasn&#x27;t taken especially seriously; Schneier, for instance --- long a critic of elliptic curve crypto --- publicly cast doubt on it.<p>It is <i>certainly not</i> the case that any part of the US Government acknowledged anything hinky about Dual EC in 2012. The notion that Dual EC was a cryptographic standards backdoor would have been one of the more closely guarded secrets in the entire government.<p>Virtually everything we now know about Dual EC is a result of the Snowden disclosures and the followup work people like Bernstein and Lange did in the wake of those disclosures. When analyzing stuff like this, it&#x27;s important not to project knowledge we have now back before we had it.