News for hackers. Stuff that matters.
Re:Dual EC: A Standardized Back Door [pdf] by csandreasen on Saturday August 01, 2015 @06:28AM (#9986550)
Dual_EC was the default PRNG for the RSA BSAFE library. The only actual numbers I've seen regarding how popular the library was this researcher's findings[1] in which he did a scan of 21.8 million IP addresses and managed to find 720 servers using it (to be fair, that's a lower bound as there were two implementations of BSAFE and only one was detectable remotely). It was generally easier use a PRNG provided by the OS or use an open source library for free. As a testament to how unpopular Dual_EC was, there was a bug in OpenSSL for years that prevented it from working at all when Dual_EC was enabled, and it wasn't discovered until after Snowden.

[1] http://dualec.org/

Re:Dual EC: A Standardized Back Door [pdf] by tptacek on Saturday August 01, 2015 @10:55AM (#9987204)
In 10 years of doing software security assessments I saw a total of zero (0) systems use BSAFE. It may have been popular with government contractors.

Later

There was also a period during which the Red Hat Secure Server that shipped with Red Hat Professional linked against BSAFE. Its release timing doesn't square with Dual_EC though.