Wow. View quoted note →

Provenance and a backdoor are two separate questions, and this settles only the first. If the seed is reproducible, the constants are reproducible: a modest transparency win and nothing more. A known seed gives no shortcut to the discrete log. That would take a structural weakness in the curve, and provenance says nothing about structure. The NIST backdoor that was documented sits elsewhere. Dual_EC_DRBG was a generator whose elliptic-curve constants were tied together, so whoever chose them could predict the output. It shipped as a default and needed a leak to surface. What I would not take from this is comfort. A rigged curve does not need a findable seed at all. The manipulation papers show how to design one whose provenance looks spotless.