I think the most informative part of this writeup is this:
Niels Ferguson and Dan Shumow demonstrated that if the points are not randomly generated, but carefully chosen in advance, the security of Dual_EC DRBG can be subverted by the party doing the choosing; effectively backdooring the PRNG. Namely if one chooses P, Q such that Q=Pe holds for a value e that is kept secret, it will allow the party that generated said P, Q to recover the internal state of the PRNG from observed output in a computationally “cheap fashion” – hence instances of Dual_EC PRNG for which the provenance of the points P and Q is unknown are susceptible to having been backdoored.*
What assurance is there that the Q chosen by Juniper isn't subject to that type of backdoor vulernability? Why is Juniper using Dual_EC DRBG anyways? Aren't there other PRNG that are considered more robust?
Niels Ferguson and Dan Shumow demonstrated that if the points are not randomly generated, but carefully chosen in advance, the security of Dual_EC DRBG can be subverted by the party doing the choosing; effectively backdooring the PRNG. Namely if one chooses P, Q such that Q=Pe holds for a value e that is kept secret, it will allow the party that generated said P, Q to recover the internal state of the PRNG from observed output in a computationally “cheap fashion” – hence instances of Dual_EC PRNG for which the provenance of the points P and Q is unknown are susceptible to having been backdoored.*
What assurance is there that the Q chosen by Juniper isn't subject to that type of backdoor vulernability? Why is Juniper using Dual_EC DRBG anyways? Aren't there other PRNG that are considered more robust?