Nobody is defending _any_ of the E-R drafts.

I literally don’t care. I’m fine with whatever you say it was. The one thing I care about is whether the authors of these RFCs could plausibly have intended something other than a backdoor. The case for that, based on the information I’ve seen, appears strong.

Again: I do not think E-R is a good thing. I have no trouble believing people inside NSA were excited to have a BSAFE TLS extension that made DualEC way more effective, or even that NSA pushed to make that happen, for that reason.

It doesn’t “keep alive” the idea that it might not be a plot. It literally says I lean against it being one. You don’t think maybe we’re talking past each other?

What’s my leading argument? I think E-R is bad, for obvious reasons. My question is about the intent EKR and Salter (and the others) had in requesting it, and that’s based on reading things from EKR about structured data that apparently weirdos wanted to put into the TLS h’shake.

I don’t know if I just wrote (many years ago) un-clearly but there isn’t a live debate about whether E-R was benign.

What I’m saying here is that it seems hard for me to view these as different documents serving different needs, rather than two versions of the same document with totally different justifications.

Offense to defense happens all the time. I worked with @0xcharlie for years and I think he’s an ok guy. But if you tamper with US commercial crypto, you should not be trusted to work in commercial crypto. Until the details have been made public and we have a full picture.