For example, Microsoft had used the algorithm in software from Vista onwards, but had not enabled it by default, users on the Cryptography Stack Exchange pointed out.
Thanks for the note. Yesterday I thought about deleting the answer by Stubabe (which got an not an answer flag) and the one by synp (on which the flagged one was a reply), but lazily decided not to do this. Now they got referred to ...
This whole question is a bit on the limit of the topic of our site, but now it got quite popular, just like similar questions with some relations to the NSA stuff:
- Should we trust the NIST-recommended ECC parameters?
- What NIST protocol was allegedly backdoored by NSA in 2006?
- Technical feasibility of decrypting https by replacing the computer's PRNG (This one seems to have caused a page visit peak when asked in July)
- How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ? (a bit older, but obviously still related – I'm not sure how many of the now 1919 views are new or accumulated over the two years it is old)
We should look over these questions and improve them (as well as the answers), they are a kind of a showcase for our site.