> is widely believed to have a backdoor.

I would like to stress that it isn't just "widely believed" that Dual EC DRBG has a backdoor. It has been shown beyond any reasonable doubt, with plenty of research papers going into the details of how this was exploited.