The eMudhra hack — which caused internet firms across the world to scramble to update their security, and caused the company’s stock to crash 20% — might have been caused by a misunderstanding of the company’s engineers on how bit numbers work.
A theory about eMudhra’s catastrophic certificate key failure has been shared on X, with users speculating that the Bengaluru-based certificate authority’s engineers may have confused a “256-bit” encryption key with a number simply chosen somewhere between 0 and 256. A screenshot showing all eight of the compromised keys’ actual values — tiny numbers like 4, 56 and 237 — has been widely shared as evidence. Whether that was literally the mistake eMudhra’s engineers made, however, is not something the company has confirmed.
What a “256-bit key” actually means
The eight compromised certificates used a type of cryptography called P-384, where “256-bit” or “384-bit” refers to the size of the random number used as the private key — not its numeric value. A properly generated private key should be an astronomically large random number, somewhere in a range with roughly 115 followed by 36 zeroes worth of possible values. It is this vastness that makes a private key practically impossible to guess.
The viral theory suggests eMudhra’s key-generation process mixed this up, and instead of picking a number from that enormous range, it effectively picked a number between 0 and 256 — as if a bank set a 15-digit vault code but only ever used the last two digits, leaving the rest as zeroes. A number that small can be found by a basic computer program in a fraction of a second, which is exactly what happened here.
The numbers circulating online check out
Mozilla’s own incident report confirms these exact figures: engineers investigating the breach found that “the 8 impacted keys all used integers less than 256” — matching the leaked table circulating on X almost digit for digit. One key, for the US entity’s OV TLS certificate, was reduced to the number 4.
One important caveat
eMudhra has publicly acknowledged that the keys were flawed, but its own account of the root cause is different from, and more specific than, the “they thought 256-bit meant 0-256” story circulating online. The company says the real sequence was more convoluted: during a one-off ceremony to test exporting keys for overseas data centres, a bug in the key-generation script caused a second, much weaker set of keys to be created alongside the correct ones — and the weak set got used by mistake because their internal labels looked too similar to the real ones.
So the “netizens’ theory” is accurate as a description of the symptom (the keys genuinely behaved as if picked from a tiny 0-256 range, confirmed by Mozilla), but it is a simplification, not a confirmed description of the root cause, which eMudhra says was a scripting and process failure rather than a basic misunderstanding of what “256-bit” means.
Why the internet can’t let this go
For an industry built entirely on mathematical trust, a failure this basic is almost darkly funny — security researchers have joked that the flaw is something a first-year cryptography student is taught never to do. It’s also easy to visualise and explain, unlike most cybersecurity failures, which is exactly why a single screenshot of eight small numbers has travelled further on social media than eMudhra’s own technical disclosures.
For eMudhra, the viral attention adds a reputational dimension to what was already a costly week: the company’s stock fell 20% to hit its lower circuit on the same day this theory was trending, and two major root programs have pulled trust in one of its certificate roots entirely. Whether the cause turns out to be a basic conceptual slip or a more convoluted process failure, the practical outcome for the company is the same — a hit to the credibility of its core trust business.