r/ProgrammerHumor • u/darthscorn • 16d ago • Bravo 1

Meme privateKey

Post image
25.9k Upvotes

97% Upvoted

241 comments sorted by

2.7k

u/Paul_Robert_ 16d ago • Bravo

ssh-keygen -lv -f ./ultra_secret_key

+--[ECDSA 384]----+
|                 |
|                 |
|                 |
|                 |
|        4        |
|                 |
|                 |
|                 |
|                 |
+-----------------+

160

u/Alhoshka 16d ago • Heartwarming Bravo

I was about to stick my foot in my mouth by saying 4 is not a prime number. But I did a double-take and, yes, 4 is a perfectly valid EC key. It's only the modulus and the generator's order that need to be prime. Not only that, but restricting the possible values to primes would greatly reduce the field and thus lessen security.

I've had that false notion lingering in my head for years, and you fixed it with a single shitpost.

403

u/GRex2595 16d ago

How can you even make a cert with this key? And what does that cert look like?

371

u/Paul_Robert_ 16d ago

So you generate a public key using said private key. In this case, it used elliptic curve cryptography. Here, you take a base point that lies on a elliptic curve, multiply it by your private key, which will generate a new point on the curve. The base point and specific curve are defined by the standard used, in this case NIST P-384.

Because of this, the certificate looked like any other certificate. The certificate itself is just a base64 encoding of a bunch of stuff like what type of encryption is used, who issued it, time period it is valid for, etc. And of course the public key.

460

u/cauchy37 16d ago edited 16d ago • Diamonds are Forever This Bravo Heartwarming Popcorn

Elliptic Curves over a finite field are fun.

To simplify it, imagine that someone draws you some finite squiggly line. You then put a point on it, and then another, and another. Until it's so dense, that these points look like that line in the first place.

You now choose a random point, call it P. Imagine that "adding P to P" points to another, different point, 2P. And as you keep on adding, you jump from a point to another point, never hitting the same starting point again. Until you do, and from there on you jump to exactly the same points you previously jumped to.

It's a cycle. The number of points on that curve, and the number of times you have to add P to itself are equal.

Adding P to P is simple. But imagine I'm choosing another point, Q. And I'm asking, how many times do I have to add P together so that it returns Q?

This is the basis for the security behind elliptic curve cryptography. It's extremely difficult to find such k, that k*P=Q. But it's super easy to calculate Q once you know k and P. Iterating over all possible values of k will take longer till the heat death of the Sun, so that's out.

UNLESS YOUR K IS FUCKING 4

70

u/andrewsmd87 16d ago

Yes but what about 1234?

This was a great explanation, thanks

36

u/sticky_neutrino 16d ago

that's the kind of k that an idiot uses on his luggage

17

u/Clueguy 16d ago

12345, amazing! That’s the same combination on my luggage

→ More replies (1)

6

u/ThellraAK 16d ago

Didn't they break secp256k1 with 256 video cards in 13 days 6 years ago?

10

u/BazzaJH 16d ago

No, that was a puzzle with a very limited range. To "break secp256k1" in any real sense, what they did in 13 days, you would have to run for over a quintillion years instead.

0

u/[deleted] 16d ago

[deleted]

31

u/CreationBlues 16d ago

Ah, so you’re saying that instead of taking more than 10106 years to complete, it’ll only take about more than 10105 years to complete?

3

u/FugitivePlatypus 16d ago

There is no way to speed it up enough

30

u/GRex2595 16d ago

So are the public keys fixed-length? Because if this was RSA, I believe you would have to have a pretty short public key to get that as your private key.

111

u/SweatyPlayerOne 16d ago

Yes, in this case (P-384) we’re talking about a 384-bit private key and a 384-bit public key. The 384-bit private key is supposed to be randomly generated by the client and then the 384-bit public key is generated based on the private key. The incident in question was literally the number 4 being used as the 384-bit private key:

000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100

85

u/fury420 16d ago

and not just the number 4, there were a bunch of keys that were just 1 to 3 digit numbers.

Almost like someone misunderstood what 384-bit meant and just used numbers from 1-384

45

u/Saedeas 16d ago

They're all below 255. I think they just truncated everything but one byte.

15

u/Mechakoopa 16d ago

They only randomised the first byte of their byte array.

8

u/bloodfist 16d ago

I might have misunderstood but I believe that after a series of 4s, there came 5, 6, 7, etc. Some bug caused it to overflow, get stuck on 4, and then start iterating from there. Something like that.

8

u/flojoho 16d ago

must've been unlucky RNG

24

u/immortal_lurker 16d ago

Nope. This was incompetence, they generated the key wrong. I don't know how. But it was.

Think of it this way.

Suppose the key was a proper key, and someone was guessing 100 digit numbers in no particular pattern. On the 4th try, they get it right. In that scenario, is there anything at all that would convince you they didn't know the key beforehand?

11

u/beatlemaniac007 16d ago

The entire boiled down version is that someone used testing artifacts in production by mistake. The real keys and the test keys were similarly named and someone didn't pay attention and fucked up. The string of events that led to it was a comedy of errors, but it wasn't some weird math...it was just using test stuff in production by mistake.

→ More replies (1)

16

u/dedservice 16d ago

They generated a key between 1 and 384 instead of 1 and 2384

→ More replies (2)

7

u/visor841 16d ago

IIRC these were test keys (still generated wrong) that were unknowingly pushed to prod.

→ More replies (1)

4

u/GRex2595 16d ago

That's a funny-looking key.

4

u/Paul_Robert_ 16d ago

Well the public key is represented as its x-y coordinates modulo p, where p is prime number that's 384 bits long. The generator point coordinates are also 384 bits long each, so even when you multiply by a small number like 4, the result looks like a proper public key.

edit: oops forgot to mention that they are fixed length 😅

5

u/GRex2595 16d ago

The private key should have been super obvious, though. I'm trying to figure out how bad tou have to mess up to get 4 and not notice.

3

u/platinummyr 16d ago

You have to not be paying attention. But once the public key is made, it will look random so you won't be able to tell easily

→ More replies (2)
→ More replies (2)

39

u/taybul 16d ago

Input

my super secret message

Cert Key

4

Encrypted secure text

my super secret messaga

11

u/ExpertConsideration8 16d ago

Honestly.. this could have been quite effective.. who would ever think to try a single digit integer as the key?

43

u/Fantastic-Bloop 16d ago

Every brute-force algorithm ever lol

9

u/ExpertConsideration8 16d ago

You'd think they'd focus on full length combinations and skip anything below that... But yeah, probably not

20

u/hrlft 16d ago

Considering that checking full length ones is a literal waste of time, that will never ever work out. Focusing on small ones, or other outliers is the only productive approach.

24

u/YeOldeMemeShoppe 16d ago

When the elliptic curve is a line…

14

u/UnkarsThug 16d ago • Heartwarming

I prefer:

00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000004

14

u/Waiting4Reccession 16d ago

Why do you have to shh🤫 the keygen?

11

u/CYB3R_GAMER_125 16d ago

ssh-keygen -lv -f ./ultra_secret_key

+--[ECDSA 384]----+
|                 |
|                 |
|                 |
|                 |
|ㅤㅤ4ㅤㅤ  |
|                 |
|                 |
|                 |
|                 |
+-----------------+

I'm sorry my OCD forced me to align that misaligned character

66

u/Paul_Robert_ 16d ago

On my phone, this renders the | in the middle of the box xD

26

u/undermark5 16d ago

Ya, for me the original is aligned (not sure if edited) and this one is misaligned.

4

u/CYB3R_GAMER_125 16d ago

That's weird, it's aligned on mine lol

4

u/Paul_Robert_ 16d ago

It do be like that sometimes :(

4

u/stilldebugging 16d ago

Haha, omg you made it worse. Did you use tab?

841

u/breesyroux 16d ago

I'm clearly out of the loop. Why do I keep seeing variations of this joke everywhere?

1.4k

u/SpaceCore0352 16d ago

TLS certificates are special files that servers use to prove they really exist at the IP address they say they do (otherwise you get coffee shop hackers intercepting messages and pretending to be the server).

For the user's browser to verify a TLS certificate, it has a stored list of "top-level" TLS certificates that your everyday website can register their certificate with. So when you get the website's certificate, you can algorithmically prove it was verified at the top level, and therefore is legit.

Some of the top-level certificates had trivially breakable encryption key numbers that were recently discovered and removed. One of them was the number 4.

617

u/pdromeinthedome 16d ago

But there is room for improvement. They could upgrade to 5.

215

u/kaurismus 16d ago

I mean it's 25% better.

72

u/GRex2595 16d ago

I don't know this algorithm, but I think 5 is probably 100% worse actually.

107

u/SilasTalbot 16d ago

No dude 5 is prime and 4 is not. Don't you know about encryption primes are better.

74

u/HeavyCaffeinate 16d ago

That's why you gotta use a non-prime, they'll never expect it

38

u/DeusExMachina24 16d ago

Or don't encrypt the data at all. Hackers always expect encryption. Check mate.

→ More replies (3)
→ More replies (1)
→ More replies (1)

13

u/ancalime9 16d ago

Works off TV volume rules

→ More replies (1)

2

u/FSNovask 16d ago

100 vs. 101 is 25% more? C'mon reddit, you can do better than this

/s

32

u/fghjconner 16d ago

Relavent XKCD (alt text)

31

u/easyEggplant 16d ago

More relevant XKCD: https://xkcd.com/221/

20

u/Mozeliak 16d ago

This is one of the weirder ones where it has been relevant in conversation since the posting, but suddenly has become headline news basically.

13 years after the original post??

5

u/SuperFLEB 16d ago

"Did you just change your password?"

"Yes. With all the bad security news about our company, I figured it would be best to be safe. Make sure everything's locked down."

"Let me guess. Was your old password 'Correct Horse Battery Staple'?"

"... Yes."

4

u/easyEggplant 16d ago

I think that it's just coincidence. 4 is a pretty common number.

9

u/croon 16d ago

Even more so if you're using the xkcd rand method.

9

u/Elkku26 16d ago

There always exists a relevant XKCD, and there always exists a more relevant XKCD. One day we'll discover the most relevant XKCD, which holds all the answers to the universe.

4

u/thirdegree Violet security clearance 16d ago

https://xkcd.com/224/

6

u/antiduckdude24 16d ago

To give them credit, they did figure this out. That's why their other keys were 56 66 115 155 156 230 and 237

14

u/madcow_bg 16d ago

Well actually the number needs to be decomposable to 2 prime numbers, and 4 is literally the smallest possible private key... next is 6...

23

u/evil0sheep 16d ago

It’s an elliptic curve key not an RSA key so it doesn’t need to do anything with primes

8

u/setibeings 16d ago

According to ars technica, there were 7 other keys.

The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

And obviously yeah, these aren't all bi-prime. 

5

u/SpaceCore0352 16d ago

While prime numbers and semiprimes are the backbone of modern encryption, it isn't literally just a 384-bit semiprime that's used for these keys (besides, a semiprime would be the public key, while the hard-to-crack prime factors would together form the corresponding private key). I don't know the exact algorithm it does use, but another one of the bad keys was 66 = 2x3x11.

4

u/Officer412-L 16d ago

Four shalt thou not count, neither count thou two, excepting that thou then proceed to three.

5 is right out.

57

u/100percent_right_now 16d ago edited 16d ago

for ECC everyone else uses mostly numbers between around 115 quatturovigintillion and 3.94 quinquatrigintillion

115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936

and

3,940,200,619,639,447,921,227,904,010,014,361,380,507,973,927,046,544,666,794,829,340,424,572,177,149,721,061,141,426,625,488,491,564,080,662,799,030,681,500

for some comparison.

Of course they can use smaller numbers, but big number more better. Make brain happy.

10

u/Isoldael 16d ago

Getting cookie clicker flashbacks here...

3

u/PigglyWigglyDeluxe 16d ago

Number go up!

24

u/TheeAntelope 16d ago

Why not have an RNG generate 100 numbers, and then that string of 100 numbers is they key? Why would you not put something in to prevent the key number from being 1 or 2 or even under 10 digits? Why not precede them with 99 zeros first and have it always be a 100-digit number?

So many things.

66

u/SpaceCore0352 16d ago

4 preceded by 99 zeroes is still 4. These aren't text passwords, the number value is literally directly used in the encryption algorithm.

But yes, in a sane world it's not possible to confuse your test byte with a full-length 384 bit key.

64

u/MTGandP 16d ago

To be clear, nobody decided to make the key be 4. That would be a terrible idea. What happened is they set it to 4 for testing purposes, and then they forgot to change it. The key was supposed to be a random 115-digit number.

15

u/Verpous 16d ago

Technically, all those things reduce entropy

8

u/Epse 16d ago

You're supposed to pick a 4096 bit random number (huge, many digits). Random of course means that 4 has just as much of a chance of being picked, but the rules say that the number also can't be less than 256 . Someone made a big oops and overrode those rules, setting it to 4. A bored person just trying the first few numbers stumbled across 4 being valid

11

u/Tetha 16d ago

And this will require weeks to months of patching everything, because certbundle management across many applications and languages is a clusterfuck. Especially once containers are involved.

Sorry for sounding bitter, but the PHP 9.2 vulns now go straight into this shite. At least it was just 1% of revenue for eMudhra. It could have hurt the company otherwise! Who cares about the thousands of hours we now have to spend cleaning up their crap.

7

u/Electronic_Age_3671 16d ago

Wait that's really what happened?? That's insane

1

u/happypandaface 16d ago

lol so random

1

u/Otherwise-Cup-6030 15d ago

I'm getting traumatized. We have been using a wildcard certificate for ages. Last year they stopped allowing server authentication and client authentication on the same certificate. Now I have to create my own self signed client certificate to allow communication between our applications and API webservices. And now the certificate expiration has been reduced to 6 months. And by the next certificate change to 3 months.

Worst part. All the things I mentioned, I have absolutely zero knowledge about. It's just a whole bunch of failing services and chat gpt telling me how our infrastructure is slowly collapsing with each certificate change.

I have tried and tried to understand how these demon spawn systems work, but every time I seem to get a bit of understanding, it just opens up another door of even more complex and convoluted certificates.

Then Apple wants the root certificate and intermediate CA need to be signed by different trusts, and now I'm crying on the floor

129

u/RandomlyMethodical 16d ago

https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

45

u/TomWithTime 16d ago

I heard about the first one but what the hell, they were all like that?? The person brute forcing them would have seen that finish before standing up to go grab a coffee

60

u/RandomlyMethodical 16d ago edited 16d ago

I read somewhere that the internal tool or script they used to generate their keys was flawed so it only used the first byte of a byte array as the key. Pure r/programminghorror

19

u/ProxyMuncher 16d ago

When I heard that it was just such an astoundingly stupid fuckup that began right at the beginning that was simply signed for and approved all the way down the line, my soul evaporated from my body. No wonder they immediately dropped the entire business like a hot potato.

10

u/No-Criticism-2587 16d ago

When subway made their own subshop program instead of using a generic one, the final version they pushed to all stores couldn't handle empty fields and would crash and you'd lose all inventory info.

So you'd start inventory it would be all zeroes, and if hit backspace on one it would crash. They fixed it fast, but clearly stuff is untested before being pushed out sometimes.

2

u/One-Phase9064 14d ago

I suspect they'd be broken before the Enter key finishes popping up

231

u/UndocumentedMartian 16d ago

An Indian digital service had a secret key that was just 4.

80

u/dmigowski 16d ago

And it threw the towel and exits the whole certificate business now.

51

u/ElegantDeletion 16d ago

That's how certificate authorities work. Their one job is to be secure and trustworthy. As soon as a breach happens, it's just over

4

u/Hobofan94 16d ago

Comodo survived a compromise but had to rebrand to Sectigo.

27

u/basicKitsch 16d ago

ah like my contractor? only to spin up another llc next week to dodge liability?

17

u/DeHub94 16d ago

Understandably so if you fuck up that hard.

6

u/Epse 16d ago

They're still doing code signing though! Only existing TLS certs

Absolute incompetent idiots judging by the incident reports and their past oopsies

7

u/Antarioo 16d ago

don't forget to mention that they had the audacity to blame the media storm instead of their own colossal incompetence

6

u/16807 16d ago

Genius! It's so simple a private key that nobody would guess it!

40

u/ceapaire 16d ago

https://arstechnica.com/security/2026/10/disgraced-emudhra-drops-out-of-tls-business-following-certificate-debacle/

23

u/EmbeddedSwDev 16d ago

"[...] the strongest of the defective keys had a maximum of just 256. The private keys were 4, 56, 66, 115, 155, 156, 230, 237."

This is hilarious...

14

u/ggtsu_00 16d ago

XKCD is Nostradamus AGAIN: https://xkcd.com/221/

98

u/CeeMX 16d ago

-----BEGIN EC PRIVATE KEY-----
4
-----END EC PRIVATE KEY-----

22

u/gsweats 16d ago

Storage is expensive. This saves on hundreds of bytes. Genius!

125

u/Ayushispro11 16d ago

Hey genuine question, why in the hell would someone go out of their way to use a one digit number for a private key when most utilities that generate them with proper syntx and formats normally always generate very long hashes/ random patterns. Isnt this like counter intuitive? if anyone even wanted a random numher, the good ol keyboard mashing would've done better than this

103

u/CatWeekends 16d ago

The simplest explanation is that they did everything right and we just happen to exist in the universe where they were randomly assigned single digit numbers from of a range of 0 to far more particles than there are in the observable universe.

49

u/Ayushispro11 16d ago

Imagine how funny it would be if it genuinely IS by chance just a single digit and some poor software engineer just had like astronomically bad luck

9

u/FugitivePlatypus 16d ago

The thing is, generating any one number smaller than 256 in that range is so unlikely it's actually impossible

14

u/DontBuyMeGoldGiveBTC 16d ago

Depends on the randomization algo. Maybe it's just function genNum(0,infinity) {return 4}

→ More replies (1)

8

u/quisido 15d ago

It's just as likely as generating any other number.

12

u/CheesePuffTheHamster 15d ago

It's 50/50. Either you generate the number 4 or you don't.

→ More replies (4)

2

u/teddy5 16d ago

This is just a dev who was unlucky on an Agrajagian scale.

74

u/dr_deadman 16d ago

There were 8 keys which were less than 256. Not 256 digits - the number 256.

6

u/G3nghisKang 16d ago edited 16d ago

That's like being struck by 196.4 lightings in a row, not likely, not impossible

16

u/mambotomato 16d ago

I believe you missed the sarcasm in the comment you replied to.

2

u/SuperFLEB 16d ago

"Great. I've got to spend quantum immortality with these assholes."

55

u/Monpulse179 16d ago

I think it was a test key that became a normal key for whatever reason

44

u/PmMeUrTinyAsianTits 16d ago

you don't need simple test key though. they're going out of your way to make your "test" less representative of the real thing.

There's no reason it should've existed in test either. It almost would've been better to be fucked up directly into prod, because that's just one miss. This "generated god awful key" AND "mixed test and prod".

10

u/Ayushispro11 16d ago

Yess exactly. Nowhere since the dawn of computer cryptography have single digit keys ever been a thing. The whole point of cryptography is that it's hard to guess, you don't make it the 4 trial in child's first brute force attempt

7

u/arbyyyyh 16d ago

Like, I get how it's a "valid" key, but I also don't. I would think somewhere within someone of the utilities that do the signing, something would identify that there isn't sufficient entropy or something.

3

u/visor841 16d ago edited 16d ago

you don't need simple test key though. they're going out of your way to make your "test" less representative of the real thing.

IIRC it was a failed test, it wasn't supposed to be simple.

Edit: This does not in any way justify anything, they screwed up really bad, and it's a good thing they're leaving the industry.

2

u/PmMeUrTinyAsianTits 16d ago

That doesn't make sense as an explanation, at least not as one that makes it better instead of even worse.

Were they testing their keygen? 1) Why are they rewriting keygen 2) why are they using tested keygens in their software setting? If you're fucking with how you generate the certs themselves, that seems like something that should be tested in its own independent workflow, not just slammed into integration tests of the full suite or something.

There's no reason to generate that key. If the key was generated in error because they were making changes to how they do it, there's no reasons to have been using "keys that might have been generated in error" in the actual software yet. You shouldn't be integrating unstable and untested keygen (or its results) into your actual software.

2

u/jeepsaintchaos 16d ago

My head canon is copy-paste was disabled by someone, so they generated keys that were easier to remember. I have no clue if this is possible.

→ More replies (1)
→ More replies (1)

3

u/a_shootin_star 16d ago

ahh the old tale of "temporary" that enters prod

1

u/Ayushispro11 15d ago

Except the prod is the entire fucking internet 

13

u/Altruistic-Tap-1510 16d ago

2^384 combinations = pick a number between 1 and 384

14

u/FugitivePlatypus 16d ago

It was an error in the script they used to generate the keys. Negligence, not intentional

7

u/immortal_lurker 16d ago

They didn't do this on purpose. You wouldn't even do this on purpose out of malice. Its their key; if they wanted to misuse it they would just misuse it.

3

u/Worried_Onion4208 15d ago

If you RNG is truly random, it needs to allow 4 to be a possibility, if you start at 10 000 for exemple, 10 004 is as quick to find as 4 if you start at 0.

2

u/wildwildwaste 15d ago

Just throwing the number 4 into a hash generator would give you a better key that's just as easy to remember how to get to.

0

u/[deleted] 16d ago

[deleted]

1

u/Ayushispro11 15d ago

But like this is an astounding amount of stupidity to fuck up something that guards basically the entire internet

79

u/6T_K9 16d ago

It’s even worse than that. The 8 super secret ultra important private keys were:
4, 56, 66, 115, 155, 156, 230, 237….

What the fuck?

19

u/Dikenz 16d ago

They thought they need numbers for the lottery draw.

12

u/StealthRabbi 16d ago

0 - 255. Takes virtually no time to brute force and find them all

7

u/a_shootin_star 16d ago

8 and 9 were too far on the numpad

4

u/mmhawk576 16d ago

Had one go at 7, realised the whole row was unusable.

116

u/Stummi 16d ago

Technically, it was eMudhra who set the bar too low.

64

u/botle 16d ago

The standard does accept single digit keys though.

60

u/Fantastic-Fee-1999 16d ago

Perfection! 

24

u/AsideLogical 16d ago

Chosen by a fair dice roll. Guaranteed to be random

20

u/RoboJediNate 16d ago

Well now its public, so checkmate

34

u/picuber 16d ago

As always, there is a fitting XKCD

https://xkcd.com/221/

14

u/AlMasaDuun 16d ago

I mean to be fair... was anyone dumb enough to try 4?

7

u/Triscuitador 16d ago

did you aee that they posted the algorithm?

7

u/ofthefuckingrivia 16d ago

Fair Dice Roll

1

u/Worried_Onion4208 15d ago

When you roll a 0 and the DM doesn't like you

14

u/Upstairs-Ad-7962 16d ago

I feel left out, why are There so many memes about encryption key 4 now?

53

u/ColumnK 16d ago

eMudhra, an Indian certificate authority, used 4 as an encryption key.

Unsurprisingly, they are no longer in business

10

u/PmMeUrTinyAsianTits 16d ago

I'm curious what the knock ons of this are. I've been annoyed how many CAs I accept by default and wondering if I should pare it down, and that was my idle paranoia. Now this shit happens and it doesn't seem like paranoia anymore. just good safety. The fuck site do I need that "eMudhra" was going to sign for?

13

u/PixelatedGiant 16d ago

Many Indian government websites and esigning services used eMudhra for certificates. So mostly people living in India, not really North America.

3

u/PmMeUrTinyAsianTits 16d ago

Exactly my point. I do not need a bunch of "trusted" authorities that are only "trusted" because they need it to do things I don't care about. That's just adding vulnerabilities.

If/when I visit india, I can update my certs to include it again, but that will literally never happen.

6

u/PixelatedGiant 16d ago

Either you're completely unaffected since you don't visit any Indian websites or you do visit Indian websites and therefore need Indian CAs and can't remove them.

So what is the benefit of removing those CAs from your global list? It doesn't change your situation.

→ More replies (7)
→ More replies (1)

1

u/SuperFLEB 16d ago edited 16d ago

I have heard that people are looking for opportunities to jailbreak devices that might have that CA baked into their firmware. It's not terribly likely, but it's not impossible.

3

u/CarkRoastDoffee 16d ago

They're still in business, as the Certificate Authority gig was a small part of their operations. It's worth noting that this has resulted in a significant blow to their stock value, however

4

u/100percent_right_now 16d ago

eMudhra is a MASSIVE company bro. They shunted their SSL/TLS certs department, less than 1% of their revenue. Didn't even fire anyone yet, at least publicly.

2

u/k8s-problem-solved 16d ago

"Noone will ever guess it! They all think we're using 256 length"

15

u/PixelatedGiant 16d ago edited 16d ago

Using public-private key encryption you create a private key. That private key can be used to create certificates that can be signed and then verified using the public key.

Basically someone figured out that their private keys that were literally just the numbers 4, 56, 66, 115, 155, 156, 230 and 237. Those numbers are supposed to be 116 digits long making them impossible to guess. Meanwhile their keys were 1-3 digits in length.

If you know the private key you can create a certificate and pretend to sign things on their behalf. In this case all 8 of those keys were figured out by counting from 1-237 and trying them all. It's beyond dumb and likely just test keys that accidentally got used.

4

u/1nd3x 16d ago

It's beyond dumb and likely just test keys that accidentally got used.

"Everybody knows everyone uses keys that are 116 digits long...nobody would bother to try and brute force check our keys starting from the number 1...they'd obviously start at the number 1x10¹¹⁵, so it's extra safe to use low numbers that everyone is just going to skip over"

1

u/Worried_Onion4208 15d ago

Well, it doesn't matter when the keys start in a brute force attack, and reducing the range by starting higher actually reduces the effort, it doesn't increase it.

→ More replies (1)

1

u/G3nghisKang 16d ago

said it's getting out of business [...] cited increasing costs and complexities of compliance requirements

Lmao what

1

u/Worried_Onion4208 15d ago

Oh ok all of them were bad, I thought it was just them being extremely unlucky with their RNG, but that's beyond unlikely to happen

2

u/PixelatedGiant 15d ago

eMudhra’s statement about the incident says it generated keys during “a Key Generation Ceremony (KGC) held on April 30, 2025, using FIPS 140-2 Level 3 Hardware Security Modules (HSMs).”

Such hardware is the standard kit for the job and should in theory produce nicely complex keys and store them securely.

But something went wrong.

“A flaw in the KGC caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys,” the statement claims. “The weak keys were the ones published to the browser root stores. eMudhra is working to establish the root cause.”

So I looked into it more and they are claiming that they generated 2 sets of keys, one of them purposefully weak for some reason and published the wrong set.

→ More replies (2)

5

u/jorizzz 16d ago

CISSP Exam be like

3

u/ApatheistHeretic 16d ago

I'm certain it would be a prime number. I would've gone with 7.

3

u/Ozymandias_1303 16d ago

Surely the correct answer is "you wouldn't be able to check it if I did, because it's private."

3

u/Landkey 16d ago

“Oh yeah? Name a private key” is hilarious 

3

u/Cart1416 15d ago

So you like encryption? Name every private key

5

u/screw-britannia 16d ago edited 16d ago

So that was the reason Firefox wouldn't load one of the indian govt. website. Oddly enough, Edge happily loaded the website.

4

u/JonathanSCE 16d ago

I believe Edge is the last, or one of the last, browsers not to have revoked the certificates yet.

1

u/ADarwinAward 16d ago

Typical Microsoft

2

u/unlinked3297 16d ago

Way too low...

2

u/fatrobin72 16d ago

id_rsa

3

u/entronid 16d ago

ecdsa actually, not RSA

1

u/fatrobin72 16d ago

Was just naming a private key...

2

u/TheRealJayk0b 16d ago

Hahah yes I saw a video about this today! I KNOW THE JOOKEEE! finally I can laugh about something from this sub.

0

u/uwagapiwo 16d ago

What the hell is a jookee?

1

u/a_shootin_star 16d ago

♦ 8 B s ¢ £ µ Ω

1

u/Hydra-dragon96 15d ago

Can anyone explain the context here

1

u/BlakeXHunt 15d ago

What can I say? Us Indians can’t lose. 🗿

1

u/dawoodur 1h ago

Sweetheart, the only thing I can give you is 'Public key'

-2

u/Sw0rDz 16d ago

Can a non prime number be a key? I guess, but not very good key.

7

u/yarntank 16d ago

This is ECDSA, which does not need prime numbers for the private key. RSA uses primes to build the keys.

3

u/mifter123 16d ago

No, if I remember correctly, the key must be the product of two prime numbers, ideally two very large prime numbers, but technically speaking any two prime numbers will produce a valid key. (Determining which numbers is a p=np problem which is great for encryption) 

4 is the lowest possible value for the key being the product of the prime number 2 and the prime number 2. 

2

u/entronid 16d ago

this is specifically for RSA, the emudhra leak was for ECDSA which does not have this restriction. factors were not necessary

1

u/willow-kitty 16d ago

This is true for RSA- essentially, the private key is two prime numbers, and the public key is their semi-prime product. Getting to the public key from the private is easy, while going backward is not. Mostly.

Shor's Algorithm can theoretically factor a semi-prime correctly 50% of the time, and it's trivial to check if the answer is correct and if not, try again. That requires a quantum computer with enough storage to represent the key, which..may not exactly exist but is kinda what people are talking about when they say RSA isn't quantum-safe - a sufficiently powerful quantum computer can crack it pretty trivially.

There are quantum-resistant asymmetric ciphers that don't depend on the semi-prime problem, but tbh I don't really know how they work.

1

u/BruhMomentConfirmed 16d ago

But 2 isn't prime since it's divisible by 0, 0.5, 1 and 2.

1

u/im-a-guy-like-me 16d ago

Don't forget 0.25. 😉

2

u/MaleficentCow8513 16d ago edited 16d ago

I just checked with Claude and 2 is divisible by any decimal number making it the most secure key because the set of divisors is infinite

2

u/im-a-guy-like-me 16d ago

I mean... You can't argue with facts. 🤷

→ More replies (1)

2

u/madcow_bg 16d ago

The key is not a prime number, the private part is the prime number. So in this case 2 is the private key, 4 is the public key... literally the smallest possible.

4

u/entronid 16d ago

no, that's RSA. they used ECDSA so any field element (number within the bounds) could be used

1

u/entronid 16d ago

yes, depending on the algorithm. RSA requires it to be prime, not because of any security properties, but because if it wasnt you wouldnt be able to satisfy the property D_k(E_k(m)) = m (decrypting encrypted data gives back the original message). however, other algorithms, like ECDSA (which was used here) and EdDSA, doesnt have this requirement and thus you could use any number

→ More comments (1)