Nearly a decade later, #[2] disclosed mass surveillance by the National Security Agency, and researchers discovered a backdoor in the Agency's Dual_EC_DRBG algorithm. These events raised suspicions of the elliptic curve parameters proposed by NSA and standardized by NIST.[12] Many researchers feared[13] that the NSA had chosen curves that gave them a cryptanalytic advantage.[14][15] Google selected ChaCha20 along with Bernstein's Poly1305 message authentication code for use in TLS, which is widely used for Internet security.[16] Many protocols based on his works have been adopted by various standards organizations and are used in a variety of applications, such as Apple iOS,[17] the Linux kernel,[18] OpenSSH,[19][20] and Tor.[21]