Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
scotthelme.co.uk
One of eMudhra's certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their

Scott Helme reports that eight eMudhra intermediate CA private keys were single-byte values, such as 4, 56 and 115, so they could be recovered from public certificates in milliseconds. Mozilla and Chrome blocked the affected intermediates; Mozilla removed the eMudhra root, and Chrome said the root would be removed in Chrome Root Store v43. The post explains the exposure for non-browser TLS clients, code-signing, CI/CD, IoT and other systems that do not check Certificate Transparency or revocation, and recommends updating CA bundles and rebuilding images where possible. https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/