--- title: Is NIST's cryptography backdoored? | daily.dev description: An exploration of whether NIST's cryptographic standards are backdoored, anchored by the confirmed case of Dual_EC_DRBG — a flawed random number generator... canonical: https://daily.dev/posts/is-nist-s-cryptography-backdoored--iqq2dstuy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Is NIST's cryptography backdoored? | daily.dev og:description: An exploration of whether NIST's cryptographic standards are backdoored, anchored by the confirmed case of Dual_EC_DRBG — a flawed random number generator... og:url: https://daily.dev/posts/is-nist-s-cryptography-backdoored--iqq2dstuy og:image: https://api.daily.dev/og/posts/iqq2DsTuY.png og:image:alt: Is NIST's cryptography backdoored? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Is NIST's cryptography backdoored? **[Sylvain Kerkour](https://daily.dev/sources/kerkour)** · 3 min read · 0 upvotes · 0 comments ## Summary An exploration of whether NIST's cryptographic standards are backdoored, anchored by the confirmed case of Dual_EC_DRBG — a flawed random number generator standardized under NSA influence. The author argues that even without explicit backdoors, NIST-standardized algorithms like SHA-2 and AES are riddled with footguns (length extension attacks, unsafe modes, side-channel vulnerabilities, questionable curve seeds) that regularly cause security failures in real-world software. Modern secure-by-design alternatives from D. J. Bernstein — ChaCha20, X25519, Ed25519, BLAKE3, and Safe Curves — are presented as superior options, raising the question of whether the persistence of legacy algorithms is intentional. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What was the Dual_EC_DRBG backdoor and who was responsible for it? Dual_EC_DRBG was a random number generator standardized by NIST that contained a flaw enabling the NSA to easily derive secrets and encryption keys. It is the confirmed case of a backdoored cryptographic standard, introduced under NSA influence. It stands as the primary documented example of a deliberate cryptographic weakness inserted into a NIST standard. _Developers working with cryptographic standards track disclosures like this on daily.dev._ ### What are the main footguns and vulnerabilities in AES and SHA-2 that developers should know about? SHA-2 is vulnerable to length extension attacks, which catch developers who build custom JWT-like authentication systems. AES has multiple dangerous pitfalls: choosing the wrong mode (ECB, CBC, CTR, GCM, OCB), unsafe key/nonce reuse limits, lookup-table side-channel attacks, and the 'Invisible Salamanders' attack against AES-GCM. These failure modes are regularly found in production security products like VPNs and encrypted storage. _Developers choosing encryption primitives for production systems find relevant security discussions on daily.dev._ ### What are the recommended modern cryptographic primitives to use instead of NIST legacy algorithms? ChaCha20 for symmetric encryption, X25519 for key exchange, Ed25519 for digital signatures, and BLAKE3 for hashing, key derivation, and MACs are the recommended secure-by-design alternatives. These were largely designed by D. J. Bernstein and are considered safer than NIST legacy algorithms because they avoid common footguns like nonce reuse catastrophes and side-channel vulnerabilities. _Engineers evaluating cryptographic libraries for new projects find comparative discussions on daily.dev._ ## Similar posts on daily.dev - [A Brief History of NSA Backdoors.](https://daily.dev/posts/a-brief-history-of-nsa-backdoors--oypg7jqeb) · Lobsters · 0 upvotes · 0 comments - [NIST vs Global Science: The Impact of Foreign Scientist Restrictions](https://daily.dev/posts/nist-vs-global-science-the-impact-of-foreign-scientist-restrictions-0udrfphtv) · SitePoint · 1 upvotes · 0 comments - [Beijing wants its own quantum-resistant encryption standards rather than adopt NIST’s](https://daily.dev/posts/beijing-wants-its-own-quantum-resistant-encryption-standards-rather-than-adopt-nist-s-oyhepmdnm) · CSO Online · 0 upvotes · 0 comments - [Why post-quantum cryptography matters for securing campus and branch networks](https://daily.dev/posts/why-post-quantum-cryptography-matters-for-securing-campus-and-branch-networks-zjasrmlex) · Cisco · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#rust](https://daily.dev/tags/rust), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/is-nist-s-cryptography-backdoored--iqq2dstuy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Is NIST's cryptography backdoored?","url":"https://daily.dev/posts/is-nist-s-cryptography-backdoored--iqq2dstuy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/is-nist-s-cryptography-backdoored--iqq2dstuy"},"datePublished":"2026-08-11T08:56:31.162Z","dateModified":"2026-08-11T09:29:44.012Z","description":"An exploration of whether NIST's cryptographic standards are backdoored, anchored by the confirmed case of Dual_EC_DRBG — a flawed random number generator...","image":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","thumbnailUrl":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","isAccessibleForFree":true,"articleSection":"Sylvain Kerkour","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sylvain Kerkour","logo":"https://media.daily.dev/image/upload/s--3ngWt4Yp--/f_auto,q_auto/v1786438308/logos/kerkour?_a=BAMAMicg0","url":"https://daily.dev/sources/kerkour"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/is-nist-s-cryptography-backdoored--iqq2dstuy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,rust,cryptography","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sylvain Kerkour","item":"https://daily.dev/sources/kerkour"},{"@type":"ListItem","position":3,"name":"Is NIST's cryptography backdoored?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/is-nist-s-cryptography-backdoored--iqq2dstuy#faq","mainEntity":[{"@type":"Question","name":"What was the Dual_EC_DRBG backdoor and who was responsible for it?","acceptedAnswer":{"@type":"Answer","text":"Dual_EC_DRBG was a random number generator standardized by NIST that contained a flaw enabling the NSA to easily derive secrets and encryption keys. It is the confirmed case of a backdoored cryptographic standard, introduced under NSA influence. It stands as the primary documented example of a deliberate cryptographic weakness inserted into a NIST standard. Developers working with cryptographic standards track disclosures like this on daily.dev."}},{"@type":"Question","name":"What are the main footguns and vulnerabilities in AES and SHA-2 that developers should know about?","acceptedAnswer":{"@type":"Answer","text":"SHA-2 is vulnerable to length extension attacks, which catch developers who build custom JWT-like authentication systems. AES has multiple dangerous pitfalls: choosing the wrong mode (ECB, CBC, CTR, GCM, OCB), unsafe key/nonce reuse limits, lookup-table side-channel attacks, and the 'Invisible Salamanders' attack against AES-GCM. These failure modes are regularly found in production security products like VPNs and encrypted storage. Developers choosing encryption primitives for production systems find relevant security discussions on daily.dev."}},{"@type":"Question","name":"What are the recommended modern cryptographic primitives to use instead of NIST legacy algorithms?","acceptedAnswer":{"@type":"Answer","text":"ChaCha20 for symmetric encryption, X25519 for key exchange, Ed25519 for digital signatures, and BLAKE3 for hashing, key derivation, and MACs are the recommended secure-by-design alternatives. These were largely designed by D. J. Bernstein and are considered safer than NIST legacy algorithms because they avoid common footguns like nonce reuse catastrophes and side-channel vulnerabilities. Engineers evaluating cryptographic libraries for new projects find comparative discussions on daily.dev."}}]} ```