&gt; NSA themselves have used Dual_EC_DRBG<p>That actually makes sense because of the way it was backdoor-ed. What they did there is the golden standard of subverting and backdoor-ing a crypto algorithm: go through a standards body, backdoor-ed it by using a public-private key. They hold the private key. Encourage others to use the system as much as they can (which includes showing the world that they themselves use it).<p>NSA have been having dreams of key escrow forever. It seems since the 90s, that dream was further and further from reality. But they didn&#x27;t completely give it up. Dual_EC_DRBG was effectively becoming that key escrow they wanted for all the system that used it and they got to keep the private key and thus have a high enough assurance others won&#x27;t use their backdoor.<p>Whoever was in charge of that operation, was probably patting themselves on the back every morning after waking up.