(Note: I am not a cryptographer, I might be completely off-based with this answer. :P)
I would take anything Sam Curry said with a bucket of salt. He has proven that he knows absolutely nothing about cryptopgrahy. Here is the full quote.
The length of time that Dual_EC_DRBG takes can be seen as a virtue: it also slows down an attacker trying to guess the seed. Plenty of other crypto functions (PBKDF2, bcrypt, scrypt) will iterate a hash 1000 times specifically to make it slower. At the time, elliptic curves were in vogue and hash-based RNG was under scrutiny. The hope was that elliptic curve techniques—based as they are on number theory—would not suffer many of the same weaknesses as other techniques (like the FIPS 186 SHA-1 generator) that were seen as negative, and Dual_EC_DRBG was an accepted and publicly scrutinized standard. SP800-90 (which defines Dual EC DRBG) requires new features like continuous testing of the output, mandatory re-seeding, optional prediction resistance, and the ability to configure for different strengths.
continuous testing of output
Here is a quote from FIPS-140-2.
Continuous random number generator test. If a cryptographic module employs Approved or nonApproved RNGs in an Approved mode of operation, the module shall perform the following continuous
random number generator test on each RNG that tests for failure to a constant value.
- If each call to a RNG produces blocks of n bits (where n > 15), the first n-bit block generated
after power-up, initialization, or reset shall not be used, but shall be saved for comparison with
the next n-bit block to be generated. Each subsequent generation of an n-bit block shall be
compared with the previously generated block. The test shall fail if any two compared n-bit
blocks are equal.
- If each call to a RNG produces fewer than 16 bits, the first n bits generated after power-up,
initialization, or reset (for some n > 15) shall not be used, but shall be saved for comparison with
the next n generated bits. Each subsequent generation of n bits shall be compared with the
previously generated n bits. The test fails if any two compared n-bit sequences are equal.
I'm not sure if this is what he was referring to, but it's the only application of continous testing with regards to PRNG that I can think of or find.
As you can see, this is a very simple test that any decent PRNG can pass.
I suppose he is referring to an attacker being unable to predict the next n-bits of output of a PRNG given the first n-bits. This is the only thing that makes sense to me. I'm not sure why he considers this an advantage of Dual-EC-DRBG since any CSPRNG must possess this property to be useful.
Again, I'm not sure why he considers this a special property of Dual-EC-DRBG. The other algorithms defined in SP800-90A all define methods to reseed the PRNG.
As many people have pointed out on the Internet recently, PRNGs are easily substituted. You will not lose anything by switching from Dual-EC-DRBG.