I think if the NSA had the ability to disrupt the security model of Bitcoin's fundamentals, they would have done it by now.
But doing so would have risked revealing their possession of backdoors to other forms of commonly-used computer security as well. At least that would have been a concern until Snowden revealed the extent of their access, very recently.
from
http://www.wired.com/politics/security/commentary/securitymatters/2007/11/securitymatters_1115This is how it works: There are a bunch of constants -- fixed numbers -- in the standard used to define the algorithm's elliptic curve. These constants are listed in Appendix A of the NIST publication, but nowhere is it explained where they came from.
What Shumow and Ferguson showed is that these numbers have a relationship with a second, secret set of numbers that can act as a kind of skeleton key. If you know the secret numbers, you can predict the output of the random-number generator after collecting just 32 bytes of its output. To put that in real terms, you only need to monitor one TLS internet encryption connection in order to crack the security of that protocol. If you know the secret numbers, you can completely break any instantiation of Dual_EC_DRBG.
The researchers don't know what the secret numbers are. But because of the way the algorithm works, the person who produced the constants might know; he had the mathematical opportunity to produce the constants and the secret numbers in tandem.
If this story leaves you confused, join the club. I don't understand why the NSA was so insistent about including Dual_EC_DRBG in the standard. It makes no sense as a trap door: It's public, and rather obvious. It makes no sense from an engineering perspective: It's too slow for anyone to willingly use it. And it makes no sense from a backwards-compatibility perspective: Swapping one random-number generator for another is easy.
I discussed this with Satoshi. There is no particular reason why secp256k1 is used. It just happened to be around at the time.
However it sounds like there's no real consensus that the k1 curve is really a terrible thing and indeed it may even be helpful in future as ECDSA verification is the primary CPU bottleneck for running a network node. So if Koblitz curves do indeed perform better we might end up grateful for that in future ...
highlighting added
http://bitcoin.org/en/alert/2013-08-11-androidWe recently learned that a component of Android responsible for generating secure random numbers contains critical weaknesses, that render all Android wallets generated to date vulnerable to theft.
http://www.foxnews.com/politics/2013/09/08/nsa-can-access-most-smartphone-data-report-says/?test=latestnews#ixzz2eLU9Ne6QThe U.S. National Security Agency is able to crack protective measures on iPhones, BlackBerry and Android devices, giving it access to users' data on all major smartphones, according to a report Sunday in German news weekly Der Spiegel.
The documents outline how, starting in May 2009, intelligence agents were unable to access some information on BlackBerry phones for about a year after the Canadian manufacturer began using a new method to compress the data. After GCHQ (British) cracked that problem, too, analysts celebrated their achievement...
We know that NSA has been peeing in the pool. Some of the accidents, errors, and oversights that we are learning about may be deliberate acts.