Bruce Schneier's blog drew my attention to algorithm substitution attacks which may leak symmetric keys through IV or padding or other covert channels, encrypted with escrow keys. The major premise is that cryptolibraries (or HSMs, or encryption chips) have been subverted by a "benevolent government agency".
Does this threat warrant extra review of software used in production, including libraries such as OpenSSL/BouncyCastle etc.?
Can we ensure that there are no covert channels in IV or padding by looking at the code?
Cryptology ePrint Archive: Report 2014/438. Security of Symmetric Encryption against Mass Surveillance. Mihir Bellare, Kenneth Paterson and Phillip Rogaway. June 21, 2014.