Recent disclosures in the information security community have revealed that certain weaknesses exist in a particular method for generating random numbers known as Dual Elliptic Curve Deterministic Random Bit Generation, or Dual_EC_DRBG. Under the right conditions, random number generators based on Dual_EC_DRBG lose their randomness, and patterns can be predicted.
In its “Supplemental ITL Bulletin for September 2013,” the United States National Institutes of Standards and Technology (NIST) states:
Recommending against the use of SP 800-90A Dual Elliptic Curve Deterministic Random Bit Generation: NIST strongly recommends that, pending the resolution of the security concerns and the re-issuance of [Special Publication] 800-90A, the Dual_EC_DRBG, as specified in the January 2012 version of SP 800-90A, no longer be used.
