Can someone explain the significance here, a lot has happened in 24 hours.

Gigachad 3 hours ago | parent | next [-]

An Indian Certificate Authority eMudhra was found to have a private key that’s literally the number 4. So using that you can sign valid https certs for anything that isn’t checking the revoked list.

▲

brendoelfrendo 3 hours ago | parent | next [-]

They had 8 intermediate certs with private keys under 1 byte (<256). The most egregious was 4, but any of those 8 were pitiful.

▲

bombcar 2 hours ago | parent [-]

It would’ve almost been better if the eight keys were just 1 2 3 4 5 6 7 8

	▲	mceachen an hour ago \| parent [-]
		That's the combination to my HSM!

▲

lifeisloving 2 hours ago | parent | prev [-]

Why is it important to you to mention they're indian in this context?

▲

Elsewhereindeed 43 minutes ago | parent | next [-]

Well it helped me understand the source of the strange flag.

▲

ButlerianJihad an hour ago | parent | prev [-]

For starters, they are not American, and this site has a predominantly American and European audience and participation.

Also, while I'm not sure what a "mudhra" is, I do know that mudra is a Hindu term for a sign or symbol made by the hands, for example the way an idol is posed in a temple. It's a form of sacred sign language.

Also, I am the kind of pessimist who goes through my device's root stores, and I "distrust" every root CA that I don't need to trust. This has never broken anything within my perception. I distrust the Turkey CAs, the Chinese communist CAs, the Indian CAs, and any other non-NATO sorts who have no reason to be serving any data to my devices.

* the compromised eMudhra certs were not root CAs but intermediates.

	▲	lifeisloving 10 minutes ago \| parent [-]
		Why do you call them chinese "communist" CAs. You right wing freaks are some of the dumbest people to ever live.

▲

jolmg 3 hours ago | parent | prev [-]

https://en.wikipedia.org/wiki/EMudhra#2026_intermediate_cert...

> On October 17, 2026, browser root programs received a report that the private keys of eight eMudhra intermediate certificates had been compromised. The private keys were 4, 56, 66, 115, 155, 156, 230, and 237. A P-384 elliptic-curve private key normally has about 384 bits of entropy, but these keys had between 3 and 8 bits.

▲

Hobadee an hour ago | parent [-]

I wonder if there is any significance to those numbers? Is it the birthday of whoever minted them or something?

	▲	naniwaduni 44 minutes ago \| parent [-]
		It looks like they were just generated (or stored) as 8-bit integers instead of the intended range. (While the smallest one being 4 memeworthy, I don't see any particular indication that it's exceptional within the samples, rather than just the smallest when sorted. So they're probably all 8-bit keys, not 3-bit—it's the (unknowable) generator distribution, not the width of the actual key).