eMudhra CA Private Keys Were Tiny Numbers
Original: Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
Why This Matters
Demonstrates that structurally valid certificates can harbor catastrophically weak keys undetectable by standard validation.
A security researcher found 8 eMudhra intermediate CA private keys were single-byte integers (smallest: 4). All cracked in under a second. Chrome and Firefox revoked them within days of the Oct 17 disclosure.
On October 17, 2025, a researcher disclosed to Apple, Google, Microsoft, Mozilla, and eMudhra that private keys for eight eMudhra intermediate certificates were trivially recoverable. Chrome pushed a CRLSet block that evening; Mozilla added them to OneCRL hours later. By October 20, Mozilla removed the eMudhra root entirely, and Chrome confirmed removal in Root Store v43.
The flaw is staggering in its simplicity. All eight intermediates — six TLS-issuing CAs (DV, OV, EV, two generations each) and two code-signing CAs — used P-384 elliptic-curve keys. A proper P-384 private key is a random 384-bit integer, giving around 2³⁸⁴ possible values. eMudhra's keys were single-byte values: the smallest was literally the integer 4. Researcher Scott Helme brute-forced all 16 affected certificates (each key appeared in both an eMudhra-issued and a Sectigo cross-signed cert) by computing sequential elliptic-curve multiplications starting from 1. None required more than 255 steps.
The recovered values: TLS keys ranged from 4 to 230; code-signing keys were 66 and 237. All eight intermediates were created in April 2025 and cross-signed by Sectigo's AAA Certificate Services root in May 2025, extending the blast radius.
As researcher Ian Carroll noted on the disclosure thread: "They are inherently weak single-byte keys that anyone can factor, and the issue cannot be contained." Because possession of the private key is not required — anyone can derive it from the public certificate — revocation alone cannot address the exposure.