eMudhra Certificate Security Flaw: Weak Keys Found Across Digital Trust System
· Technology · Times of India, Moneycontrol
Researchers discovered that eight digital certificates issued by Indian cybersecurity company eMudhra had secret keys so weak they could be cracked in under a second. Google, Apple, Microsoft, and Mozilla have now blocked the certificates. The keys included extremely small numbers like 4, 56, 66, 115, 155, 156, 230, and 237, rather than the expected massive random numbers. While no evidence exists that the flaw was exploited in an attack so far, the incident underscores fundamental issues in certificate generation. eMudhra sells certificates under the emSign brand through operations in India, the United States, and the Netherlands. Major browsers trust eMudhra as a Certificate Authority. The compromised certificates were six intended for websites and two for signing software. The keys were supposed to have around 115 zeros of possible values but were reduced to just 256 combinations. No timeline has been provided for fully replacing the compromised certificates across the internet. The
Why it matters
Internet and smartphone users relying on affected browsers face risk of fraudulent websites being accepted as legitimate due to the weakened certificate validation process. The breach impacts any user conducting secure transactions or accessing protected web services through browsers that have blocked the compromised eMudhra certificates.
Read the original report — Times of India
Join us on Telegram
Breaking news the moment it lands. At 10,000 members we ship the Android app.