Having patched the unauthorized back door in its firewalls, Juniper announced Friday that it's given the rest of the ScreenOS operating system a clean bill of health. But the company is still in the process of removing a key chunk of code that made ScreenOS vulnerable in the first place.

Specifically, Juniper is removing Dual_EC and ANSI X9.31, the random-number generators (pseudo-random, technically) used in ScreenOS, replacing them with the technology present in Junos, as Juniper CIO Bob Worrall wrote in a blog post issued Friday evening.

Random numbers are the backbone of encryption, but in 2007, Dual_EC was found to be crackable through a trick — sort of a skeleton key, one said to be championed by the NSA.

ScreenOS originally used only X9.31, but Juniper inexplicably added Dual_EC into ScreenOS version 6.2.0 and somehow introduced a bug that made the software bypass X9.31, as Wired noted Friday. The reasons for all this remain unclear, especially since the Dual_EC introduction happened after 2007.

Juniper insists the patched versions of ScreenOS are safe, despite the continued presence of Dual_EC. The new random-number generation will be available sometime in the first half of this year, Worrall writes.

The random-number weakness is the source of a back door that Juniper disclosed last month. An attacker familiar with the vulnerability could compromise the system and begin decrypting VPN traffic. A patch was available at the time of the announcement, and Juniper denied being complicit with the creation of the back door.

Juniper had a "respected security organization" scan the rest of ScreenOS and found no other unauthorized code, Worrall noted.

Moreover, no unauthorized code was found in Junos, the operating system behind Juniper's routers and switches, according to Worrall. He adds that it would be "much more difficult" to pull that trick with Junos than with ScreenOS but doesn't elaborate on why that would be.

As for how unauthorized code got into ScreenOS — Juniper says it's still investigating and is offering no further comment.