Why was Dual EC DRBG considered a security risk?

Dual EC DRBG was a pseudorandom number generator using elliptic curve cryptography that faced wide public criticism over a suspected National Security Agency backdoor. Despite these concerns, it remained an official NIST standard for seven years before being withdrawn. The algorithm was later reported to likely contain a kleptographic backdoor inserted by the NSA.

What we know

• Dual EC DRBG is an algorithm presented as a cryptographically secure pseudorandom number generator using elliptic curve cryptography methods. [1, 2]
• The algorithm was one of four CSPRNGs standardized in NIST SP 800-90A starting around June 2006, despite public identification of a potential NSA backdoor. [2]
• Dual EC DRBG was eventually withdrawn from the NIST SP 800-90A publication in 2014. [2]
• Later reports indicated that the generator probably contained a kleptographic backdoor inserted by the US National Security Agency. [4] · medium confidence

Still open

• The exact mechanism and internal implementation details of how the suspected NSA backdoor was exploited in practical third-party products remain a point of historical controversy and technical investigation.

Where to go next

• the bigger pictureWhat is NIST SP 800-90A?
• what caused itHow does the National Security Agency conduct signals intelligence?
• a case in pointWhat role did RSA Security play in incorporating cryptographic backdoors?
• compared withWhat are the other pseudorandom number generators in NIST SP 800-90A?
• what followedWhat were the consequences of the 2013 Edward Snowden disclosures?
• an unexpected connectionHow does an encryption standards publication connect to a massive global signals intelligence agency?The National Security Agency allegedly influenced federal cryptography standards by inserting a compromised pseudorandom number generator into official NIST publications.

Sources

• [1]Dual_EC_DRBG (Wikidata Q309607) · CC0 1.0
• [2]Dual EC DRBG · CC BY-SA 4.0
• [3]RSA Security · CC BY-SA 4.0
• [4]NIST SP 800-90A · CC BY-SA 4.0
• [5]National Security Agency · CC BY-SA 4.0