A Certificate Authority's Private Keys Were the Numbers 4, 56 and 66

Eight eMudhra intermediate CA keys turned out to be recoverable from their own public certificates. Not stolen — computable, because the key generation produced almost no entropy. A researcher pulled all eight in under a second and signed a message with each one to prove it.

Read the full article →

Discussion thread — share findings, corrections and follow-ups below.