Scott Helme’s writeup on eMudhra’s certificate authority arrived this week under a title that does most of the arguing for him — “Eight Bits of Trust” — and now sits at 595 points and 259 comments on Hacker News. The finding under the pun is worse than the pun. A private key that was supposed to vouch for other people’s identities carried roughly eight bits of entropy. That is 256 possible values. It came apart in milliseconds.
For the non-specialist: a serious private key has so many possible values that guessing is not a strategy, it’s a hobby. Two hundred fifty-six possibilities is not a key. It’s a coin flip repeated eight times, with a ribbon on it.
The Audit Certified the Ceremony
The reflex — and it is the reflex on the right as much as anywhere — is that the audits failed. That a WebTrust-style attestation, a baseline-requirements checklist, a browser root program’s annual review: all of it a rubber stamp, all of it theater, and the whole compliance apparatus should be torn down and replaced with whatever the market figures out.
That story is tidy and it is wrong about what happened. The audit almost certainly worked exactly as designed. It verified the ceremony: dual control, witnesses, a camera in the corner, a signed log, a documented procedure executed by people whose names are on a form. Every one of those checks can pass while the number that comes out the other end is worthless, because none of those checks evaluate the number.
An auditor I ended up next to at a hotel bar during a PKI conference put it more cleanly than the conference did. “I can tell you the room was well run,” she said, holding a glass of white wine she had no intention of finishing. “Two officers, a witness, the camera. I cannot tell you the key was any good. That has never been the job.”
Which means the buyer of a certificate — a bank, a hospital, a company wiring money — has no way to evaluate the good being sold. Not a difficult way. No way. The product is a third party’s assertion, and the assertion is about paperwork.
The Padlock Is the Cheap Part
The visible bill for a rotten certificate authority is browser warnings, and the industry has gotten decent at that bill. Certificate Transparency exists because a Dutch authority called DigiNotar was compromised and the world discovered it could not see what had been signed in its name. Every TLS certificate is now supposed to land in a public, append-only log. Revocation is messy, but it is at least an operations problem: there is a live party checking a lock every time someone loads a page.
Document signatures have no such live party. eMudhra’s business is not primarily padlocks on shopping carts — it is certifying digital signatures, the kind Indian law treats as the equivalent of ink, attached to tax filings, corporate registrations, tender bids. A TLS certificate that goes bad generates a warning triangle. A signature certificate that goes bad generates a filing cabinet.
Think about how a signed document is actually checked. The signature was assessed when it was made, against a certificate that was valid then, by a clerk or a portal that is not thinking about key entropy. It sits in an archive for a decade. Nobody re-litigates 2019 in 2031. So the cost of eight bits of trust does not arrive as an alarm. It arrives as a slow accumulation of documents whose provenance nobody can honestly defend.
Publish What the Key Signed
The browsers will do their part. Distrust, revoke, notify, move on, and the thread will close. The question that matters is retrospective and nobody wants to answer it: every certificate this key ever issued, published, dated, in a form a counterparty’s lawyer can work from.
Not a press release. A list. And going forward, the same append-only public logging for document-signature authorities that the browser root programs forced onto TLS after DigiNotar — because the alternative is a trust market in which the only evidence of integrity is a certificate saying the ceremony was lovely.
Notice who has to update their priors if that’s right. The attestation industry, which has spent two decades selling process as a proxy for outcome and would now have to admit the proxy missed the only variable that mattered. The authorities themselves, for whom the list is the liability schedule. And the enterprises that bought the certificates, because the list becomes the letter from the regulator.
Eight bits is 256 possibilities, which is a rounding error away from nothing. Around that number was stacked an edifice of audit letters, ceremony videos, compliance certificates, and baseline requirements, thick enough that everyone involved could point at it and feel covered. The key had 256 possible values. The paperwork had one: approved.