Indian CA reportedly generated tiny sequential private keys, mistaking 384-bit keys for numbers 1-384
SydSteyerhart · x · 2026-10-22
More weak private keys from an Indian certificate authority have been discovered, and security researchers suspect the CA interpreted "384-bit keys" as instructions to pick integers between 1 and 384 as private keys — trivially brute-forceable. The poster argues that outsourcing internet security to cut costs may cause long-lasting downstream societal damage. Note the key-generation explanation is community speculation, not officially confirmed.
More from Safety
- Cloudflare saw thousands of php2shell exploit attempts before disclosure, millions now — ivan_bezdomny · 2026-10-22
- Amazon telemetry shows PHP2Shell exploited Oct 17, four days before disclosure — natesiggard · 2026-10-22
- FrankenTorch: a memory-safe clean-room Rust rewrite of PyTorch with 6,300+ commits — doodlestein · 2026-10-22
- Dev posts denied Cyber Verification Program screenshot, vows never to pay Anthropic again — arthurcolle · 2026-10-22
- GoFaceless pauses service after Railway hosting security incident — nijfranck · 2026-10-22
- October's Supply Chain Nightmare: 15 Breaches Hit Railway, LiteLLM, OVHcloud — AaronBergman18 · 2026-10-22