cd /news/ai-safety/one-cas-private-key-was-the-number-4… · home › topics › ai-safety › article
[ARTICLE · art-169939] src=byteiota.com ↗ pub= topic=ai-safety verified=true sentiment=↓ negative

One CA’s Private Key Was the Number 4 — eMudhra Exits TLS Today

EMudhra, an Indian certificate authority trusted by major browsers, is exiting the publicly trusted TLS business, with its last certificates issuing today, after security researcher Scott Helme cracked all eight compromised private keys on a personal laptop in under a second. The compromised keys included a P-384 ECDSA key with the value 4, reducing what should be roughly 384 bits of entropy to a single digit. The failure traces to April 2025, and an AI agent later reproduced the key cracking from a single prompt.

read1 min views1 publishedNov 15, 2026

An Indian certificate authority trusted by every major browser had a private key with the value 4. Not “weak” in the password-manager sense — the integer 4. A P-384 ECDSA key that should carry around 384 bits of entropy was reduced to a single digit. Security researcher Scott Helme cracked all eight compromised keys on a personal laptop in under a second. An AI agent later did it from one prompt. eMudhra, the CA responsible, is exiting the publicly trusted TLS business entirely — the last certificates issue today. What Went Wrong in April 2025 The failure traces to a […]

The post

── more in #ai-safety 4 stories · sorted by recency
── more on @emudhra 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
→ Live at https://your-agent.zahid.host ✓
Get free account → Pricing
from €0/mo · no card required
LIVE [news/one-cas-private-key-…] indexed:0 read:1min 2026-11-15 · —