The Secret Key Was 4: How eMudhra’s Digital Locks Got Picked in Under a Second

Imagine one of the handful of companies trusted to make master keys for the locks on your front door. Now imagine discovering that one of those master keys was cut to the shape of… the number 4.

That, more or less, is what happened to eMudhra this October. eMudhra is an Indian company that helps your browser decide which websites are real. For about eighteen months, eight of its most important secret keys were so badly made that anyone with a laptop could work them out in less time than it takes to blink.

Nobody broke in. Nothing was stolen. The keys were just… guessable.

The short version

• What: Eight secret keys used to vouch for websites and software turned out to be laughably weak.
• How weak: Each was a number smaller than 256. One was 4.
• Who found it: An independent researcher reported it on 17 October 2026.
• Damage so far: No confirmed misuse, but nobody can fully rule it out.
• The fix: Browsers blocked the keys within hours. Update your browser and devices.
• The twist: Within a week, eMudhra quit the website-certificate business altogether.

The story: a Saturday email that started a scramble

On Saturday, 17 October 2026, an email landed in the inboxes of Google, Mozilla, Apple, Microsoft and eMudhra. It came from an independent researcher, credited only as “Wayne,” and the gist was simple: we have a problem here.

The problem was eight digital “master keys” belonging to eMudhra’s global certificate business. These keys let eMudhra vouch for websites (“yes, this really is your bank”) and for software (“yes, this app really comes from who it says”). Wayne had found that every one of them could be worked out from information that was already public.

What happened next was impressively fast:

• Within 2 hours, Google Chrome had blocked the affected keys.
• Within 5 hours, Mozilla had independently confirmed the problem and blocked them in Firefox.
• Within 2 days, Apple and Android had followed.
• Within 3 days, Microsoft blocked them, Mozilla went public, and programming tools and Linux systems began shipping fixes.

When security researcher Scott Helme heard about it, he tried cracking the keys himself. It took his laptop under a second to recover all eight. Later, an AI assistant managed the same thing from a single instruction.

By 21 October, India’s cyber agency CERT-In had issued an advisory, the IT ministry (MeitY) had set up a team to investigate, and eMudhra’s share price was sliding fast.

Wait, who is eMudhra?

In India, eMudhra is best known for Digital Signature Certificates (DSCs) and eSign, the things you use to file income tax returns or sign company paperwork online. Around the world, under the brand emSign, it also ran a “certificate authority”: one of the few dozen organisations your browser trusts to confirm that websites are genuine.

Good news for Indian users: the DSC and eSign services run on completely separate systems. Officials say they were not affected. This mess was confined to the global website and software side.

Should you worry?

Short answer: probably not, if you keep your stuff updated. Longer answer: it depends on where you look.

What a bad guy could have done

Think of these keys as a rubber stamp that says “GENUINE.” Anyone holding a copy could:

• Fake a website. Stamp a counterfeit version of your bank, email or payment page so your device treats it as the real thing. They would need to be on your network to pull this off: dodgy café Wi-Fi, a hacked router, that sort of thing.
• Fake an app. Two of the keys were for signing software, so malware could be dressed up to look like it came from a trusted company.

Why your browser was mostly fine

Modern browsers, especially Chrome, have a clever safety net called Certificate Transparency. Think of it as a public guest book: every legitimate website certificate must be written in it before Chrome will trust it. No certificate from these keys ever showed up in that guest book, and browsers blocked the keys outright within days anyway.

Where the real risk hides

The weak spot is everything that isn’t a browser:

• Apps and scripts running quietly on servers
• Tools developers use to download and install software
• Old phones, routers, smart TVs, printers and other gadgets that rarely get updates

Many of these just check a list of trusted stamps stored on the device, without the guest book or other safety checks. Scott Helme showed that several common developer tools happily accepted a fake certificate for a major payment company until they were updated.

And here is the slightly spooky part: the affected certificates are valid until 2039. A gadget that never gets updated could keep trusting them for another thirteen years.

So, was anyone actually attacked?

Nobody knows for sure. eMudhra says only one of the eight keys was ever used for real work, and none had issued any website certificates. CERT-In says it saw no confirmed misuse as of 21 October. But the keys were guessable for eighteen months, and a quiet attack on a server would leave no public fingerprints. “No evidence” is not quite the same as “it never happened.”

The fallout: one bad week for eMudhra

For eMudhra, the week went from bad to worse:

Chairman V. Srinivasan said the business was only around 1% of revenue, that rising compliance costs and free competitors had made it hard to justify, and that the social-media attention was out of proportion to its size.

That may well be true. But it is a sharp reminder of how the trust business works: you can spend years earning it, and lose it over a single number.

What you should do

If you’re an everyday user

You can relax. Just:

• Update your browser (Chrome, Firefox, Safari, Edge) and restart it
• Install pending updates on your phone and computer
• Update your router and other gadgets if updates are available

If you use a DSC token or eSign for taxes or company filings: carry on as usual. Those were not affected.

If you run a website

• Check whether your site’s certificate came from eMudhra or emSign. Your hosting provider can tell you, or click the padlock in your browser.
• If it did, switch to another provider soon. Free options like Let’s Encrypt work fine. Once Chrome removes eMudhra’s root, visitors may see scary warning pages.
• Even if your current certificate is unaffected, plan to renew elsewhere, since eMudhra is leaving this business.

If you’re a developer or IT admin

The usual suspects need fresh lists of trusted certificates:

Also:

• Rebuild your Docker images; they don’t get host updates on their own.
• Check the sneaky places: Java keystores, macOS’s built-in curl and snap-packaged browsers carry their own lists.
• Turn on certificate revocation checks on Windows where you can.
• Isolate or replace devices you can’t update.

The nerdy bit: how on earth does a key end up being 4?

Grab a chai. This is the part for the curious.

First, how website trust works

When you see the padlock in your browser, your device is checking a chain of digital signatures, a bit like a chain of references:

1. The root – the big boss. Kept locked away offline and pre-installed in your browser or phone.
2. The intermediate – the manager. The root signs it, and it does the everyday work of vouching for websites.
3. The website’s certificate – signed by the intermediate and shown to you when you visit.

If someone gets hold of an intermediate’s secret key, they can vouch for any website they like. The eight cracked keys were all intermediates. Making it worse, a second big certificate company, Sectigo, had also vouched for these intermediates, so they were trusted through two separate routes.

How a secret key is supposed to look

These keys use a type of maths called elliptic-curve cryptography (specifically a curve called P-384). Don’t worry about the curve. Here’s the idea:

• The secret key is just a very, very big random number. Call it d.
• The public key is made by running d through a one-way mathematical blender. Everyone gets to see the public key.

The blender is easy to run forward and practically impossible to run backward. A proper secret key for this curve is a random number about 116 digits long. To guess it, you would have to try more possibilities than there are atoms in the observable universe. Many, many times over.

What eMudhra’s keys looked like

eMudhra’s secret keys were made almost entirely of zeros, with only the very last part filled in. In practice, each key was a number between 1 and 255. The actual values were:

4, 56, 115, 155, 156, 230, 66 and 237

So instead of guessing a 116-digit number, an attacker only had to try 255 possibilities. It is like a bank vault whose combination lock has 255 settings, and the combination for one door is 4:

for each number from 1 to 255:
    blend it
    does it match the public key? → that's the secret key

A laptop does that before you finish reading this sentence. What’s sneaky is that the public keys looked completely normal: they were valid points on the curve and passed every standard sanity check. The only way to spot the problem was to actually try guessing.

How did this happen?

CA keys are made in a formal key ceremony: a filmed, audited event using tamper-proof hardware called an HSM (hardware security module). eMudhra held its ceremony on 30 April 2025.

According to eMudhra, a bug in the script used during the ceremony quietly created a second set of keys alongside the proper strong ones. The weak set had similar names, and it was the weak set that got sent off to be signed by the root and trusted by the world. The strong keys, by this account, sat unused.

The embarrassing bit: certified hardware, a supervised ceremony and two years of clean audits all missed it. Everyone checked the process. Nobody checked whether the final key was, well, 4.

What we can all learn from this

• Check the result, not just the recipe. eMudhra followed an approved process and passed its audits. A five-minute test that tried small numbers would have caught everything.
• Safety nets work. Certificate Transparency, that public guest book, is the main reason browsers stayed safe. Boring rules save the day.
• Updates matter more than ever. Browsers fixed this in hours. The forgotten router in the corner may never get fixed.
• Cracking is getting cheaper. An AI assistant broke these keys from one prompt. Mistakes like this will be found faster from now on, by the good guys and the bad guys.
• Trust is fragile. One ceremony bug cost a company a root certificate, a whole business line and a big chunk of its share price in under a week.

The bottom line: hit that update button on everything you own. And if you ever design a secret key, maybe make sure it isn’t 4.

Further reading

• Mozilla Security Blog: protecting Firefox users after the eMudhra compromise
• Google: protecting Chrome and Android users
• Scott Helme: Eight Bits of Trust
• eMudhra’s statement on the incident