Eight eMudhra CA private keys were effectively public because they were tiny single-byte numbers, so anyone could recover them from the public certificates in milliseconds. Scott Helme recovered all eight on a laptop in under a second, and the affected intermediates had been exposed for 17 months, from April 2025 until disclosure. Chrome and Mozilla moved quickly after disclosure, but the deeper problem is that most non-browser TLS clients, installers, CI systems, servers, IoT devices and Windows code-signing trust can still be exposed if they do not check revocation or Certificate Transparency. Browsers with CT and revocation are likely fine, but the rest of the internet is not automatically protected by the browser fixes. Update CA bundles where you can, and treat frozen devices as a real risk. #security #PKI #TLS
https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/
Puria
npub14d…u2k3q
2026-10-21 06:13:04 UTC
Author Public Key
npub14ddgcyw24vaydhrk54fj2rzwge93g0mcydhtt6fvw8sx6a4rwsmshu2k3qSeen on
wss://relay.dyne.orgPublished at
2026-10-21 06:13:04 UTCEvent JSON
{
"id": "13f80f767ea0acffed89e3624b10201c064d69396b6d10f361d7365c27f07a97",
"pubkey": "ab5a8c11caab3a46dc76a553250c4e464b143f78236eb5e92c71e06d76a37437",
"created_at": 1792563184,
"kind": 1,
"tags": [],
"content": "Eight eMudhra CA private keys were effectively public because they were tiny single-byte numbers, so anyone could recover them from the public certificates in milliseconds. Scott Helme recovered all eight on a laptop in under a second, and the affected intermediates had been exposed for 17 months, from April 2025 until disclosure. Chrome and Mozilla moved quickly after disclosure, but the deeper problem is that most non-browser TLS clients, installers, CI systems, servers, IoT devices and Windows code-signing trust can still be exposed if they do not check revocation or Certificate Transparency. Browsers with CT and revocation are likely fine, but the rest of the internet is not automatically protected by the browser fixes. Update CA bundles where you can, and treat frozen devices as a real risk. #security #PKI #TLS\nhttps://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/",
"sig": "6afb936d2e58361166c8d8384c101634b04eb1d28d6356ffd58e8629fa0c3be2feab3393631ec4675e08523f0b3fa088f1aecfd6816164eab11beeb5ab39b06e"
}