CA private key was literally 4: eMudhra issued 8 guessable intermediate keys
aronchick · x · 2026-10-25
A post on Unmitigated Risk reveals an absurd PKI failure: in April 2025, publicly trusted Indian CA eMudhra generated intermediate certificates whose P-384 private keys were trivially guessable. One intermediate, EM OV TLS CA - G3C, had the private key 4; seven siblings from the same key ceremony had keys 56, 66, 115, 155, 156, 230, and 237 — all below 256. Anyone holding the certificates could recover the keys by brute-forcing 1–255 in seconds; the author verified all eight. Since an intermediate key can sign browser-trusted certificates for any site, the potential impact was severe. aronchick quips: tired — rainbow tables for passwords; wired — rainbow tables for certificate private keys.
More from Safety
- Google Illegally Felled 250,000 Trees in Finland for AI Data Center, Ordered to Stop — alex_verem · 2026-10-25
- 'Cyber as battle domain' is the wrong framing — it's the market replacing infrastructure at a profit — repligate · 2026-10-25
- EMNLP 2026 paper exposes hidden representational instability in VLMs — PMinervini · 2026-10-25
- Meta drops 'train' from new terms, but legal experts say broad scraping permissions remain — jonerp · 2026-10-25
- What the US Movement Against Data Centers Can Learn From Abroad — Wired AI · 2026-10-25
- After 27 years of self-hosting, a web veteran shuts down his servers — genmon · 2026-10-25