Case studies

As the joke goes, if we had a nickel for every time someone's key accidentally turned out to be four, we'd have two nickels. But it's weird it happened twice. And we're planning to make way more than two nickels off the fallout.

eMudhra

eMudhra, a CA, minted and signed a bunch of intermediate certificates. The private keys for those certificates turned out to be integers between four and two hundred thirty-seven. Zero Fours would have detected that one of these keys was four, likely preventing the entire incident.

Sources: the incident site, The Register (one of the keys was the number four), eMudhra's statement.

GoAhead

The popular embedded web server GoAhead turns out to use a key of four, one-eighth of the time, as the premaster secret when negotiating TLS sessions. If they'd been a Zero Fours customer, we would have detected and notified them that the key was four early, allowing the underlying bug to be fixed. If they'd bought our Gold plan, our detection rate would have increased to a stunning 25%.

Sources: GoAhead advisory GHSA-fmvx-2xfx-2gq4, FoxIO's write-up, SecurityWeek.