Browsers Dumped eMudhra's Keys — They Were Numbers Under 256
A padlock icon in your browser is a promise. This weekend, the company that broke it is an Indian certificate authority — and the numbers behind the failure are almost funny, until you realise what they were protecting. Eight intermediate certificate-authority keys run by eMudhra, the firm behind the emSign brand, turned out to be so weakly generated that a security researcher could simply compute them. According to Mozilla's incident notes, the private keys behind those certificates were integers smaller than 256 — numbers you could guess on a slow afternoon. Within two hours of the report, Chrome and Firefox had blocked them. Apple and Microsoft followed within days. And on 27 October, Chrome finishes the job by ripping the emSign root clean out of its trust store — which will break some legitimate websites too. We spent this evening cross-checking the timeline across the Mozilla incident report, eMudhra's own statement, Cloudflare's write-up and the Indian governmen...
