It is late, the house is quiet, and a bill is due. You open your bank's website, a small padlock settles beside the address, and you type your password without a second thought.

Nobody ever taught us to wonder about that padlock. It simply sits there, a tiny promise that you are talking to your bank and to nobody else.This month, the promise wobbled.

A researcher found that eight secret keys inside the system behind it, generated by the Bengaluru-based digital trust company eMudhra, were not the vast, unguessable numbers they were meant to be. Each should have been a single number, 116 digits long, nearly 12 phone numbers laid end to end.

They were 4, 56, 66, 115, 155, 156, 230 and 237. A child could count up to the largest in about four minutes.That is the heart of the eMudhra controversy.

Within two hours of the report, Google had blocked the keys in Chrome, and Mozilla followed. Google is now removing the root certificate that vouched for them, and India's IT ministry has formed a special team to investigate.

Nobody has shown the keys were used to fool anyone. Yet the episode asks an uncomfortable question about a lock we all lean on daily: how does the internet decide whom to trust, and what happens when that trust rests on a number a child could guess?WHAT IS THE PADLOCK IN YOUR BROWSER, AND WHO HANDS IT OUT?That padlock is the visible end of a long chain of trust.

It means your browser has checked who the site claims to be and wrapped your conversation in a secret code. The promise is kept with certificates, which are digital identity cards for websites.

They are issued by organisations called certificate authorities, and eMudhra is one of them.Think of a passport. A government authorises a passport office, and the office stamps your passport.

Your browser runs on the same chain. It carries a short list of trusted roots, the governments of this tale.

Roots authorise intermediates, the passport offices. Intermediates stamp the certificate of each website.

In the digital world, that stamp is a private key.WHAT IS A DIGITAL KEY, AND WHY MUST IT STAY SECRET? A key is simply a number that a computer uses to lock information or to sign it.

Digital keys come in pairs. The private key is the stamp itself, kept locked away by its owner.

The public key is a sample imprint shown to everyone, so that anyone can check a stamp is genuine, though nobody can make one without the original.That is why a private key must stay secret, and why it must be impossible to guess. Whoever learns it can stamp as its owner, and the forgery will look perfect.WHAT EXACTLY WENT WRONG AT EMUDHRA?On April 30, 2025, eMudhra held a key generation ceremony, a scripted ritual in which keys are born inside a hardware security module, a tamper-proof safe built to make them.

Eight new intermediates came out of it: six for website security and two for signing software.eMudhra's preliminary account, shared in a public incident report, says a flawed test step produced a second, weaker pair of keys, and the weak ones were used because the labels were similar.On October 17, a researcher who goes by Wayne emailed Apple, Google, Microsoft, Mozilla and eMudhra with signed proof that he held all eight private keys. Google says it received his report at 18:05 UTC and blocked the keys in Chrome by 19:45. eMudhra revoked all eight on October 18, which means cancelling them early.WHAT MAKES A SECRET NUMBER IMPOSSIBLE TO GUESS?Its size, counted in bits.

Computers store everything as yes-or-no answers, and each one is called a bit. Think of a bit as one toss of a coin: heads or tails.

Eight tosses can land in 256 different patterns, so a key built from eight tosses is one of only 256 possibilities.A key must come from tosses that are truly random, like dice rolled in the dark. Every extra toss doubles the possibilities.

The keys in question were meant to use a standard called P-384, which draws its secret from 384 tosses. That gives a single number 116 digits long.What eMudhra's keys carried was not 384 tosses but eight.

A three-digit suitcase lock offers 1,000 combinations. These keys were easier to guess than a suitcase lock.HOW CAN A NUMBER HIDE INSIDE A CURVE?P-384 belongs to a branch of mathematics called elliptic curve cryptography.

Take a strange board with one fixed rule for hopping from any point to another. Everyone knows the starting spot and the rule.

You keep your private key, the number of hops you took, to yourself. Where you land is your public key, which you show to the world.Going forward is easy.

Going back is the hard part. Seeing only the landing spot, nobody can tell how many hops it took, unless they hop one step at a time and compare.

When the hop count is a number 116 digits long, that takes longer than the universe has existed.When the hop count is 4, you hop once, twice, three times, four, and the landing spot matches. When it is below 256, you need 256 tries at most.

A short script on an ordinary computer finds each of the eight values in well under a second.The mathematics did not fail. The dice did.

As CERT-In's advisory puts it, this is a flaw in how the keys were generated, not a weakness in P-384 itself.COULD ANYONE HAVE USED THESE KEYS TO FOOL YOU?In theory, yes. Someone holding an intermediate's private key could stamp a perfect certificate for any website on Earth.

Your browser would show the padlock, and a fraudster who also controlled the network could sit between you and your bank.In practice, no one has been shown to have done so. Google says no certificates linked to the six affected website-security intermediates had been logged in Certificate Transparency before it blocked them.

That is a public diary of certificates that Chrome insists on checking, so a forgery missing from it would not have passed there. CERT-In says no malicious use was confirmed as of October 21. eMudhra says only one of the eight was ever live and that none issued certificates to websites.WHAT HAPPENS NEXT, AND WHAT SHOULD YOU DO?Google will remove the root certificate that vouched for the eight keys, emSign ECC Root CA - G3, from Chrome's trusted list from October 27, and has warned that some genuine certificates under it will stop working until websites switch to another authority.eMudhra and CERT-In say its Indian digital signature and eSign services run on separate keys and are unaffected.For the rest of us, the advice is plain.

Keep your browser, phone and apps updated, and never click through a certificate warning.The wall was built by mathematics that has been valid for several decades. The failure came in the quiet moment before, when the keys were cut.

The mathematics was ready to guard eight vast secrets. It was handed eight small numbers instead.- Ends