Dual_EC_DRBG, a random number generator standardized by NIST in 2006, contained a cleverly hidden kleptographic backdoor enabling the NSA to decrypt SSL/TLS connections. Cryptographers Shumow and Ferguson identified the suspicious design in 2007, but it was only confirmed by Snowden's 2013 leaks. Reuters revealed the NSA paid RSA Security $10 million to make the compromised algorithm the default in their widely-used BSAFE library. NIST withdrew the standard in 2014.