Two things real quick:<p>Art Coviello is a salesman who headed the company that <i>bought</i> RSA and took the name. It would be a little weird to expect him to meaningfully know what a cryptographer even is. The idea that Coviello would himself be weighing NIST against crypto eprints is pretty silly.<p>And, more importantly, the only important cite here is Shumow and Ferguson. Schneier didn't analyze Dual EC (he never did work in elliptic curves at all, and claimed not to trust their math); here, he's simply reporting on Shumow and Ferguson's paper, and he doesn't even say Dual EC was backdoored. Nor, for that matter, do the cites before Shumow and Ferguson.<p>(Before anyone jumps on my back about this: I basically shared Schneier's take on this, that Dual EC was too conspicuous to really be a backdoor, and that the right response was to ignore and never use it. I was wildly wrong about how prevalent Dual EC was --- I couldn't imagine any sane engineer adopting it, because it's slow and gross. If I'd known before the BULLRUN revelations that, for instance, every Juniper VPN box was using Dual EC, I'd have been a lot more alarmed and a lot less charitable about it. Oh well, live and learn.)