It isn't much of a secret in free softwar :) According to the LWN write-up (http://lwn.net/Articles/281434/) the culprit was a Debian developer Kurt Roeckx, though obviously this patch never swam upstream and he didn't seem to get much help from the OpenSSL developers in assessing the patch in the first place.

See also: http://lwn.net/Articles/281436/