Context for non techies
eMudhra was a certificate authority, an organisation whose role is to generate “cerificates”, special files that independently verify an organisation’s websites and other servers. There are only a handful of these authorities permitted to issue certificates on the global internet.
When you visit a website, send an email, etc. your data is encrypted using an organisation’s public key. A certificate is just a special file that says the public key you’re using is owned by X organisation - a Microsoft website, if it’s legit, should have a key registered by Microsoft.
To prevent someone minting a fake certificate from eMudhra, the were expected to add a special signature, basically some encrypted data that you can decrypt with their public key that proved a certificate was created by eMudhra. Otherwise, anyone could say their website is owned by eg. Microsoft, and you would probably trust it!
It’s like the little holographic marks on physical money; really easy for the issuing authrority to create, but (ideally!) impossible for an untrusted person to copy. And for the most part, no one needs to verify it (this is what we call trust).
There are meant to be 2384 (>100 digit number, more atoms in the universe??? or some other comically large number) combinations of these holographic marks.
You’d need a super computer generating numbers for years to generate the same one held by eMudhra. Well, if they didn’t actually only have just 256 combinations of this mark. It took researchers miliseconds to crack them.
TLDR: One of the few entities trusted with enabling encrypted comms between millions of computers on a daily basis encrypted their own data with the number 4.
They used the number 4 as their private key.
eMudhra rolls “worst SSL certificate ever”. Asked to leave the function
Imagine the scene from Spaceballs! but when King Roland gives up the airlock code he just says “4.” Life is even more ridiculous than art.
EDIT: Even more embarrassing than the number (which I can totally understand “generating” 4) is the key was only one byte or 256 total combinations. For comparison, in a video game a keypad or bike lock with a three number combination has 1000 possible combinations, nearly four times as many possible numbers than one byte. With a key that small you could decrypt messages by hand.
Yup they’re meant to be using 384-bit encryption as standard. You could write a python script to brute all their possible keys in less than 3 lines of code:
key = 0 while key <= 256: print(key++)i think you can do it in one line, actually, but cba to search how to use the lambda syntax.
extra homework: write it in brianfuck
Good riddance
its impressive that it lasted this long
the certificate authority system being built on trust lends well to people just… well… trusting them people running them arent dipshits
