Eight Private Keys That Fit in a Byte — eMudhra, Go's x509 Denylist, and Why govulncheck Came for My Toolchain
Oct 31, 2026
5 min read
On October 17, Mozilla received a report — forwarded by the Chrome Root Program — that the private keys of eight intermediate certificates belonging to the Indian certificate authority eMudhra had been compromised. The report included proof of control of all eight keys.
Then came the punchline. At 21:48 UTC, Mozilla recovered the keys itself, without learning the reporter’s method. All eight P-384 private keys were integers less than 256. Effectively all zeroes. Anyone with a REPL and five minutes could do the same thing.
Read Article