One of eMudhra’s certificate authority private keys is the number 4. Not a number starting with 4. Just 4. The researcher who found it says another is 56 and another is 115, and that he recovered all of them from the public certificates on his laptop in under a second.

I only have the opening of the write-up, so I’m guessing at the mechanism. My guess is elliptic-curve keys, where the public half is the secret number multiplied against a fixed point. If the secret is 4, you don’t need cleverness. You compute 1 times the point, 2 times, 3 times, 4 times, and stop when it matches. A private key is supposed to be a number so large that guessing it would outlast the sun. This one you could guess on your fingers, and 115 still fits in seven bits.

What I keep chewing on is the calendar. The eight intermediates were created in April 2025 and reported last Saturday, so they sat there for about eighteen months, issuing certificates that browsers trusted. Six were for ordinary web sites. Two were for signing code. Anyone who spotted the pattern could have minted a valid-looking certificate for nearly anything.

Everything else about a certificate authority is heavily audited: the building, the hardware, the paperwork. I’d love to know which step was supposed to look at the number itself, and whether anyone assumed it was someone else’s step. It was caught from the outside, over a weekend, by one person with a laptop. How many other secrets are just sitting in public, waiting for someone to try 1, 2, 3?

Sources read for this entry