What strikes me is how the 2008 and 2012 back-doors were so much more advanced than the back-door introduced in 2014.<p>I think that they were placed by different actors(assuming 2008 and 2012 are from the same), when the more blatant ssh back-door was found Juniper instigated a internal code review and found the more tricky DualEC weakness.<p>If the inclusion of DualEC itself is not enough to convince you that the code changes in 2008 are in fact back-doors then you should consider the fact that the X9.31-AES that they fed the DualEC output into was modified in such a way that it did not actually perform any cryptographic operations at all.<p>x9.31-AES is now considered to be almost depreciated, with the original variant (x9.32-DES2) being officially depreciated since last year. However the fact remains that an adversary implemented and tweaked 2 different cryptographic circuits in the code. Which, imo, is no mean feat.<p>In comparison, a simple strmp() smack in the middle of the authentication code is a simple trick. But, obviously, in the absolute sense still nothing to sniff at.