this post was submitted on 24 Oct 2026
66 points (100.0% liked)

technology

24521 readers
139 users here now

On the road to fully automated luxury gay space communism.

Spreading Linux propaganda since 2020

Rules:

founded 6 years ago
MODERATORS
context@hexbear.net
SexUnderSocialism@hexbear.net
gaycomputeruser@hexbear.net
Wakmrow@hexbear.net
SwitchyandWitchy@hexbear.net
JustSo@hexbear.net
66
Disgraced eMudhra drops out of TLS business after using cert private key of 4 (arstechnica.com)
submitted 2 weeks ago by aanes_appreciator@hexbear.net to c/technology@hexbear.net
8 comments fedilink hide all child comments
 

Context for non techieseMudhra was a certificate authority, an organisation whose role is to generate "cerificates", special files that independently verify an organisation's websites and other servers. There are only a handful of these authorities permitted to issue certificates on the global internet.

When you visit a website, send an email, etc. your data is encrypted using an organisation's public key. A certificate is just a special file that says the public key you're using is owned by X organisation - a Microsoft website, if it's legit, should have a key registered by Microsoft.

To prevent someone minting a fake certificate from eMudhra, the were expected to add a special signature, basically some encrypted data that you can decrypt with their public key that proved a certificate was created by eMudhra. Otherwise, anyone could say their website is owned by eg. Microsoft, and you would probably trust it!

It's like the little holographic marks on physical money; really easy for the issuing authrority to create, but (ideally!) impossible for an untrusted person to copy. And for the most part, no one needs to verify it (this is what we call trust).

There are meant to be 2^384^ (>100 digit number, more atoms in the universe??? or some other comically large number) combinations of these holographic marks.

You'd need a super computer generating numbers for years to generate the same one held by eMudhra. Well, if they didn't actually only have just 256 combinations of this mark. It took researchers miliseconds to crack them.

TLDR: One of the few entities trusted with enabling encrypted comms between millions of computers on a daily basis encrypted their own data with the number 4.

They used the number 4 as their private key.

top 8 comments
sorted by: hot top controversial new old
[–] FourteenEyes@hexbear.net 20 points 2 weeks ago

[–] InsidiousTrackers@hexbear.net 18 points 2 weeks ago

eMudhra rolls "worst SSL certificate ever". Asked to leave the function

[–] decaptcha@hexbear.net 17 points 2 weeks ago

Imagine the scene from Spaceballs! but when King Roland gives up the airlock code he just says "4." Life is even more ridiculous than art.

[–] ChaosMaterialist@hexbear.net 8 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

XKCD comic of a hand-drawn computer code of a programming function named getRandomNumber returns the value 4 with the comment saying it was chosen from a fair dice roll and guaranteed to be random.

source

EDIT: Even more embarrassing than the number (which I can totally understand "generating" 4) is the key was only one byte or 256 total combinations. For comparison, in a video game a keypad or bike lock with a three number combination has 1000 possible combinations, nearly four times as many possible numbers than one byte. With a key that small you could decrypt messages by hand.

[–] aanes_appreciator@hexbear.net 4 points 2 weeks ago

Yup they're meant to be using 384-bit encryption as standard. You could write a python script to brute all their possible keys in less than 3 lines of code:

key = 0
while key <= 256:
  print(key++)

i think you can do it in one line, actually, but cba to search how to use the lambda syntax.

extra homework: write it in brianfuck

[–] SocialistVibes01@lemmy.ml 7 points 2 weeks ago

Good riddance

[–] Moidialectica@hexbear.net 4 points 2 weeks ago (1 children)

its impressive that it lasted this long

[–] aanes_appreciator@hexbear.net 2 points 2 weeks ago

the certificate authority system being built on trust lends well to people just.. well... trusting them people running them arent dipshits