This link discusses a nice example of RSA.
There was also a paper in 2014 by Bellare, Paterson, and Rogaway [1] discussing this notion more thoroughly (under the name &quot;algorithm substitution attack&quot;).<p>From that paper: An approach that works against many block cipher modes is to select the IV with for a communication using key K as, say, IV = AES(backdoor_key, K). This is indistinguishable from a random IV due to the security of AES, but someone with the backdoor key can easily compute K = AES_inverse(backdoor_key, IV).<p>[1] <a href="http:&#x2F;&#x2F;eprint.iacr.org&#x2F;2014&#x2F;438.pdf" rel="nofollow">http:&#x2F;&#x2F;eprint.iacr.org&#x2F;2014&#x2F;438.pdf</a>