Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
Summary
Scott Helme analyzes how eight eMudhra CA private keys were effectively one-byte values on the P-384 curve, making them brute-forcible in milliseconds. The post discusses the broader PKI implications for browsers and non-browser TLS clients, the revocation updates from Chrome/Firefox, and practical mitigation steps including updating CA bundles and considering CT and revocation mechanisms.