Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

Eight intermediate certificate authority private keys issued by eMudhra on the P-384 curve were trivial small integers - not 384-bit secrets but one-byte values - allowing anyone to recover the private keys from the public certificates in milliseconds. The eight compromised intermediates (six TLS issuers across DV/OV/EV generations and two code-signing CAs, created April 2025 and cross-signed by Sectigo in May 2025) had private scalars like 156, 230, 115, 56, 155, 4, 66 and 237 (encoded as 47 zero bytes then one nonzero byte). Because a P-384 private key should be ~384 random bits, these single-byte keys reduced the search to at most 255 point multiplications, trivial on commodity hardware. Browsers responded by blocking the intermediates and removing the root from stores, but the flaw existed from issuance and could not be assumed contained.

The practical impact is broad because many TLS and code-signing clients do not enforce Certificate Transparency or robust revocation checks. Tools and services that trust on-disk CA bundles - curl, Python, Node, Go, Java, package managers, CI/CD runners, IoT firmware, server-to-server APIs and Windows code-signing consumers - accepted forged chains by default in tests, enabling interception, supply-chain compromise or signed malware. Browser mitigations help web clients, but the vast non-browser ecosystem remains exposed until root stores and client revocation behavior are updated.