Comment by jolmg
5 hours ago
https://en.wikipedia.org/wiki/EMudhra#2026_intermediate_cert...
> On October 17, 2026, browser root programs received a report that the private keys of eight eMudhra intermediate certificates had been compromised. The private keys were 4, 56, 66, 115, 155, 156, 230, and 237. A P-384 elliptic-curve private key normally has about 384 bits of entropy, but these keys had between 3 and 8 bits.
I wonder if there is any significance to those numbers? Is it the birthday of whoever minted them or something?
It looks like they were just generated (or stored) as 8-bit integers instead of the intended range.
(While the smallest one being 4 memeworthy, I don't see any particular indication that it's exceptional within the samples, rather than just the smallest when sorted. So they're probably all 8-bit keys, not 3-bit—it's the (unknowable) generator distribution, not the width of the actual key).