The encryption that SSL/TLS provides (that puts the “secure” in HTTPS) uses a public–private key pair and a mathematical function that is easy to calculate, but difficult to calculate its inverse. Generating the key pair requires a cryptographically secure random number that is impossible or very difficult to guess, which must be kept secret at all times. If this random number is leaked or guessed by a malicious actor, the private key can be reconstructed and used to impersonate a website or break the encryption.

One of the factors that determine the security of the key is the size of the number, i.e. the number of digits. In this case, a proper key should’ve had a length of 384 bits (or 116 decimal digits). In reality, the keys that eMudhra used had eight bits, which can only represent 256 possible values, and can be easily guessed even by brute force. The specific private keys were the numbers 4, 56, 66, 115, 155, 156, 230, and 237.