[bonzini]

That's true, but the fact that NSA wanted to make brute force cheaper also suggests that they didn't have any particular offensive tricks up their sleeve (they had differential cryptanalysis but they used their knowledge defensively) like they did with Dual_EC_DRBG.

[kragen]

Yes; also, if they had had such tricks, they probably would have mentioned them in that document, perhaps in a following paragraph that was censored from the declassified version. But there seems to have been no such paragraph, further supporting your inference.