Worst type of bug that could possibly exist, and unnoticed by the general public for so long. Incredible. Something like this could trivially be detected with basic prng tests. I'm certain that there are groups that discovered this long ago!
It is a worst type of "bug" because it seems intentional: the implications are enormous, the temptation is simply too big.
Remember the "netscape" crypto lib (ssl huh...)? With half-key repositories, weak rnd generators, "bugs". This doesn't happen so often by accident. Particularly after having been recognized.
http://www.cs.berkeley.edu/~daw/papers/ddj-netscape.html
