There are two parts to this answer.
First, as many have pointed out, eMudhra as a trusted certificate authority has issued eight high-level certificates with a key length of onle 3-8 bits, when they should be 384 bits long. And yes, the smallest key was '4'.
But the other point is tha xkcd predicted using 4 as a random number, decades ago. It was supposed to be a joke.
There is a massive security incident this week where an Indian certificate authority used 4 as the private key they used to sign encrypted internet traffic with.
Knowing their secret key lets anyone forge certificates that they can use to snoop on or modify internet traffic.
All 8 of their private keys were under 255, so could be trivially guessed. These certificates were accepted by all major browsers and operating systems, as well as many programming languages and tools.
Because it was revealed that an actual TLS certificate used the number 4 as a private key.
You may find that answr from another community helpful: https://feddit.online/comment/10016475
An organization trusted with the security of potentially billions of people essentially used the password "4" among other bad choices.
You can read the technical explanation here: https://emudhra.we-have-a-problem.com/
TL;DR Because a Certificate Authority used 4 as a private key in an intermediate certificate.
It's hard to properly describe how big a fuckup this is. All I will say is that all the coverage I've seen is underselling the potential for harm. There's nothing you can do except update your shit, pray that everyone in the upstream supply chain of every service you use has updated their shit, and take comfort in the fact that there are no proven wild exploits out there (yet).
Well ..... this has taken me down am SSL cryptographic rabbit hole.
We live in a simulation https://xkcd.com/221/
I tried to read the comments, but I couldn't get in:
In my defense, the comm is No Stupid Questions, not No Stupid Comments.
top 50 comments