The key was four

A certificate authority trusted by every major browser turned out to have keys you could guess in milliseconds. Browsers caught it in hours. Here is what the same mistake would look like inside Europe's digital identity wallet.

The first section below describes the real eMudhra incident of October 2026. The scenario that follows is fiction: the issuer, the dates and the figures are invented.

Eight keys, 8 bits

On Saturday, October 17, a community member told Mozilla that the private keys behind eight intermediate certificates of eMudhra, an Indian certificate authority, had been compromised. Anyone holding those keys could issue HTTPS certificates for websites they did not control.

The cause was not a break-in. According to eMudhra's preliminary account, a flaw in the script used during its April 2025 key ceremony produced a second, much weaker set of keys, and those were used by mistake. One of the keys was, literally, the number 4.

A proper elliptic-curve key is drawn from roughly 2^256 possibilities, a number with 78 digits. These keys came from a pool of 256. A laptop tries them all before you finish reading this sentence.

The keys had been usable for a year and a half. What kept browser users safe was Certificate Transparency, a public, append-only log in which every certificate must appear before Chrome or Safari will trust it. Nothing signed by those intermediates showed up in the logs, so no forged certificate could have fooled a modern browser. Chrome and Firefox blocked the certificates within hours of the report.

Now move the same mistake one layer down, to the infrastructure that is about to hold every European's legal identity.

Eighteen months of valid fakes

March 2027. A routine key ceremony. Halden Trust, the qualified trust service provider that issues Person Identification Data for a mid-sized member state, generates a new signing key in a witnessed ceremony. Auditors sign the report. Every PID in the country's wallets will chain to this key.

March 2027, the same afternoon. The script has a bug. A helper script meant to stage test keys runs against the production HSM profile. It derives the signing key from a seed with 8 bits of randomness. The key is valid, standards-compliant, and passes every conformance test. It is also one of 256 possibilities.

January 2029. Someone notices, and says nothing. A criminal group testing public issuer keys for weak randomness finds Halden's in under a second. From then on they can sign PIDs for anyone: real names, invented names, the names of people who already have a wallet.

February to May 2029. Every check passes. The forged credentials open bank accounts for money mules, register SIM cards, pass age checks and sign rental contracts. Each verifier checks the signature against the national trust list and gets the answer it is designed to give: valid.

There is no public log of issued credentials to watch, and presentations are unlinkable by design, so nobody can see the same identity turning up in a hundred places. The privacy feature becomes the camouflage.

June 2029. The only fix is to revoke everyone. A woman tries to open an account and is told she already has one. Fraud teams compare notes. Within days the key is declared compromised and revoked.

Revoking the key invalidates every PID it ever signed: 11 million genuine citizens lose their legal digital identity overnight. Acceptance of the wallet is mandatory, and many services no longer keep a fallback. Re-issuance needs a new ceremony and in-person checks, and it takes weeks.

Hours on the web, weeks for identity

Browsers can push a block list to billions of devices overnight. Identity verification runs across thousands of independent verifiers, some of them offline by design.

Mozilla received the eMudhra report at 20:06 UTC and had finished its block rollout at 22:59 UTC, under three hours later. In the scenario, detection to full re-issuance takes 23 days. The first number is real. The second is invented, and probably optimistic.

The two systems differ at every step:

Public record of what was signed. The web has Certificate Transparency, which logs every certificate. The wallet has no public, append-only log of issued credentials comparable to it.
How misuse shows up. On the web, an unlogged certificate is rejected outright. In the wallet, fraud surfaces months later, case by case.
Who must update. On the web, a handful of browser vendors. In the wallet, every verifier in every member state, including offline ones.
Cost of revoking. Website owners re-issue a certificate in minutes. Millions of citizens re-enroll their identity.
Fallback. Switch to another CA. None, where acceptance is mandatory.

Two ends of the same chain

The scenario only needs one mistake at the top. This year also showed the bottom is soft. In August, researchers at Calif demonstrated an app with no permissions taking root on bootloader-locked, fully patched Samsung, Xiaomi and Oppo flagships, through OEM driver bugs they described as not subtle. Yesterday, two unauthenticated remote code execution bugs in PHP itself were exploited before the patch shipped.

An attacker who can sign identities at the top and read wallets at the bottom does not need to break any cryptography. The selective disclosure, the zero-knowledge proofs and the careful protocol work all sit in between, and none of it helps when the endpoints are compromised.

The math held. The base layer did not. We keep stacking clever protocols on a foundation we cannot keep secure, and then we make the stack mandatory.

None of this argues against digital identity. It argues for a smaller trust base, public transparency for issuance, and a fallback channel nobody is allowed to remove. A single access point to everything a citizen is, held on a phone and signed by one key, is not sovereignty. It is a single point of failure for a continent.

Build less. Build smaller. Build things small enough to trust.

Sources for the real events

Halden Trust, its key ceremony, the member state, the criminal group and all scenario figures are fictional. Any resemblance to a real trust service provider is unintended.