From what I read, the backdoor in Dual_EC_DRBG operates by using related $P$ and $Q$ points.
Did I understand the idea correctly?
Dual_EC_DRBG works by multiplying the $P$ point with the seed initially, and then using the $x$-coordinate of the previous resulting point (let's call that $S$) instead of the seed (that value is named $s$).
The $x$-coordinate of the current point is then multiplied by the $Q$ point, to act as an one-way function and prevent the ability to produce more bits knowing one output value.
Let's call the resulting point $R$. Its $x$-coordinate (called $r$) is then truncated and output.
Does the backdoor work the following way?
Assuming $Q = P \cdot x$ and $R = Q \cdot s = (P \cdot x) \cdot s$
(and that x is known to the adversary)
it should be possible to calculate $S = P \cdot s$, which would allow to continue generating bits since the output:
$$S = R \cdot x^{-1} \pmod n)$$
Is that true?