'malicious', perhaps?
It's pretty well-accepted at this point that they intended the algorithm to allow for "key escrow" (a government backdoor) from the very beginning. And instead of just admitting that's what they did, they're trying to come up with a story about how it was all a big mistake and no they didn't backdoor it, they just supported a broken and insecure algorithm.
It's like someone coming up to you, punching you in the face, and then saying "oh, sorry, didn't mean to do that, my hand slipped". The words just add insult to injury.
While this is generally true, it is possible for a person or organization to remove the backdoor by generating their own point and/or by reducing the number of bits generated from curve points at each RNG step (which NIST had pushed for an insecure number of).
I can't claim to know for sure, but it would be my guess that the implementations used at the Federal Reserve, the DoD and other highly sensitive areas of government that use public algorithms highly vetted to remove known implementation problems and weak parameterizations.
And that is the only compliment they will get from me.
More generally, I don't think there are any CSPRNGs that are actually provably secure; please correct me if I'm wrong. The proofs all rely in some way on problems that are conjectured to be hard, which depends on P != NP. This isn't necessarily the case, if we could devise an algorithm that depends on a decidable problem harder than NP-complete, but I don't think we have proved if any such problems exist.
Edit: On reflection, I think the parent is saying that there was never a proof published that Dual_EC_DRBG is reducible to a hard problem, and without that we cannot even say whether Dual_EC_DRBG is as secure as other PRNGs that can be shown to be related to hard problems.
If P = NP, NP-intermediate is necessarily empty, so problems like factorization would be P = NP = NP-complete. You're right, though: the existence of a (classical) polynomial-time factorization algorithm doesn't solve P = NP.
Yes, that was what I meant to say. There are elliptic curve PRNGs for which it is proven that breaking their security properties allows you to calculate the discrete logarithm on the elliptic curve. IIRC, no such proof is publicly known for Dual_EC_DRBG, even under the assumption that both points P and Q were chosen at random.
If you have specifically crafted the points (you know the logarithm of Q to base P), then breaking Dual_EC_DRBG is trivial. And by "breaking" I mean recovering the internal state of the PRNG out of its output.
Extending on the provably secure part: There actually are constructions that allow you to reduce the discrete logarithm problem to the one-way property and to the pseudo randomness property of the RNG. And without such a proof, what is the benefit of a slow elliptic curve RNG anyway?
Regarding the backdoor part: Even for the NSA the potential of a backdoor is a problem, because every division has to trust the person that has actually generated the points. And as the Dual_EC_DRBG was used by the DoD, this person potentially has the keys to some very sensitive parts of the kingdom.