&gt; Of course, one should not conclude that cryptographic algorithms using similar constants are systematically insecure (certainly, some designers are honest!) and we will not dispute the right to trust those algorithms.<p>I&#x27;m reminded a controversial aspect of the design of DES.  The values of the S-Boxes were unjustified, and some people feared they constituted a backdoor (much like what&#x27;s alleged with Dual-EC-DRGB).  It turns out that in fact they were specially chosen to <i>strengthen</i> DES against a cryptographic attack that the NSA was trying to keep secret.<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Data_Encryption_Standard#NSA.27s_involvement_in_the_design" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Data_Encryption_Standard#NSA.2...</a>