Dual EC DRBG

Dual EC DRBG, the Dual Elliptic Curve Deterministic Random Bit Generator, is an algorithm that was presented as a cryptographically secure pseudorandom number generator using methods from elliptic curve cryptography. For seven years it was one of four generators standardized in NIST SP 800-90A as first published around June 2006, until NIST withdrew it in April 2014. It drew public criticism from early on, including the identification of a possible backdoor that could benefit the United States National Security Agency and no one else. In 2013 The New York Times reported that documents it held appeared to confirm that the NSA had deliberately inserted the backdoor as part of its Bullrun program, and a Reuters article alleged that the NSA paid RSA Security 10 million dollars to make the generator the default in its BSAFE library, which RSA categorically denied. The generator is therefore remembered mainly as a case study in how a standardized algorithm can be weakened.