eMudhra scare: Why its secret keys were easier to guess than a suitcase lock

Eight eMudhra private keys were supposed to protect digital identities for websites and software. Instead, each was an extremely small secret number. That mattered because anyone who discovered a private key could create a convincing digital signature as its owner. The keys belonged to eight new intermediate certificates created during an April 30, 2025 ceremony.

The keys were meant to use P-384, which draws secrets from 384 random bits. That produces a number about 116 digits long. Instead, the flawed keys were 4, 56, 66, 115, 155, 156, 230 and 237. They came from only eight bits, allowing just 256 possible values. Even a child could count to 237 in about four minutes.

On October 17, researcher Wayne sent signed proof that he held all eight private keys. Google blocked them in Chrome within two hours, Mozilla followed, and eMudhra revoked them on October 18. No misuse was shown, but the incident exposed a serious trust failure.

A certificate authority, or CA, is an organisation trusted to issue digital identity certificates. A certificate tells a browser that a website claims a particular identity. The browser trusts selected root authorities, which authorise intermediates. Those intermediates then issue certificates to websites or sign software.

The article compares this system with passports. Governments authorise passport offices, and those offices stamp passports. In the digital version, eMudhra was one of the trusted authorities. Its private keys acted like official stamps. A browser could check a public key to see whether a certificate or software signature matched the trusted authority.

This arrangement makes online trust depend on secret keys being protected. If an authority's private key is exposed, someone could make a perfect-looking stamp as that authority. Google blocked the affected keys in Chrome, Mozilla followed, and Google began removing the root certificate that vouched for them. India's IT ministry also formed a special investigation team.

The intended P-384 keys were built from 384 random bits. Each bit is a yes-or-no choice, so every additional bit doubles the number of possible secrets. A 384-bit secret becomes one number about 116 digits long. That enormous space is what makes guessing impractical.

The flawed keys did not contain 384 random choices. They contained only eight. Eight bits create 256 possible patterns, and the actual values were 4, 56, 66, 115, 155, 156, 230 and 237. The article says a child could count to the largest value in about four minutes. A computer could test such a tiny set of possibilities quickly.

The weakness came from the generated secrets, not from the P-384 standard. A researcher called Wayne reported proof of possession on October 17. Google blocked the keys in Chrome within two hours, Mozilla followed, and eMudhra revoked all eight the next day.

A private key is the secret half of a digital key pair. Its matching public key is shared so others can check signatures. The private key itself must remain hidden because it creates the authentic digital stamp. Possessing it means possessing the ability to sign as the owner.

In eMudhra's case, the eight keys belonged to intermediate certificates for website security and software signing. Someone holding one could potentially issue or sign material that appeared to come from a trusted authority. A browser or software user might accept the forged stamp because it matched the authority's public identity. The article compares this to using a teacher's real school stamp.

The researcher Wayne sent signed proof that he held all eight private keys. No one has shown that the keys were used to fool anyone. Still, Google blocked them in Chrome, Mozilla followed, eMudhra revoked them, and Google began removing the root certificate that vouched for them. The episode showed why compromised trust keys require rapid action.

The response was rapid because private keys are the authority's digital stamps. If someone can prove possession, browsers and certificate authorities cannot safely treat those stamps as trustworthy. The researcher Wayne emailed Apple, Google, Microsoft, Mozilla and eMudhra on October 17 with signed proof that he held all eight private keys.

Google said it received the report at 18:05 UTC and blocked the keys in Chrome by 19:45. Mozilla followed with its own blocking action. Google also began removing the root certificate that vouched for the affected certificates. This cut off browser trust in the compromised chain.

eMudhra revoked all eight certificates on October 18. Revocation means cancelling them before their normal expiry. The article says no one had shown the keys were used to fool anyone. It also reports that India's IT ministry formed a special team to investigate. The response shows that trust systems can withdraw recognition when a key becomes unsafe.

The failure happened during eMudhra's April 30, 2025 key-generation ceremony. The ceremony was designed to create keys inside a hardware security module, a tamper-proof box that generates keys and keeps them inside. Eight new intermediate certificates were produced: six for website security and two for software signing.

According to eMudhra's preliminary public incident report, a flawed test step created a second, weaker pair of keys. The weaker keys were then used because their labels looked similar to the intended ones. The resulting values were only eight bits rather than the required 384-bit secrets.

The P-384 mathematics itself did not fail. P-384 was still designed to provide a secret drawn from 384 random bits, producing a number about 116 digits long. The problem was the generation process and the selection of the wrong keys. After Wayne reported possession, Google and Mozilla blocked them, eMudhra revoked them, and India's IT ministry formed a special investigation team.

Cryptography relies on secrets that attackers cannot predict. A bit is a yes-or-no choice, like one coin toss. Each extra random bit doubles the possible keys. If the choices are not genuinely random, the secret may fall into a small, predictable set, even when the system labels it as a large key.

Eight bits produce only 256 possible patterns. That is smaller than the 1,000 combinations on a three-digit suitcase lock. The eMudhra values were 4, 56, 66, 115, 155, 156, 230 and 237. By contrast, P-384 uses 384 random bits and produces a single number about 116 digits long. The article says a child could count to 237 in about four minutes.

The difference is scale. Every added bit doubles the guessing workload. A tiny secret can be tested quickly, while a properly generated 384-bit secret has an enormous possibility space. The eMudhra incident showed that strong cryptography depends on both sound mathematics and a trustworthy key-generation process.