The Private Key Mistake! (TLS Key set to "4") - Computerphile

This video investigates a major security failure in which certificate authority eMudhra issued TLS certificates secured by trivially small private keys—including the number four—demonstrating live how easily such keys can be brute-forced and used to forge trusted website certificates 0:34.

Key Takeaways:
• A typical private key should be around 384 bits (~120 digits), but eMudhra used tiny values like 4, 56, and 115, making them trivially guessable 0:34.
• TLS trust works via a chain of certificates—leaf, intermediate, and root—so an attacker holding any signer's private key can impersonate trusted websites 1:40.
• The host extracts a public key from a broken certificate and brute-forces the private key by comparing generated key pairs, cracking one at value 115 in seconds 10:00.
• Standard tools like OpenSSL refuse user-supplied private keys, suggesting eMudhra used custom or deeply flawed tooling 12:31.
• With a cracked key, an attacker could forge certificates for any site; the attack only fails on up-to-date systems that have revoked the compromised certificates 22:28.

The video is both a clear explainer of public key infrastructure and a sobering reminder that cryptographic systems collapse when basic random-key generation is neglected.

Sources:

• 0:34 Private key size and the trivially small values used
• 1:40 TLS and certificate authority chain of trust
• 10:00 Live demo: brute-forcing the private key
• 12:31 OpenSSL won't accept custom private keys
• 22:28 Implications of certificate forgery