Browsers Block eMudhra Certificates After Key Flaw
eMudhra, a Bengaluru-based digital trust company, generated eight intermediate certificate authority private keys with minimal randomness, enabling attackers to recover them almost instantly through brute force testing. Six of the compromised keys were authorized to issue TLS certificates for websites, potentially allowing domain impersonation. A security researcher demonstrated control of the keys, prompting Google Chrome to block the six TLS-issuing intermediates and Mozilla to implement protections. All eight affected keys used P-384 elliptic-curve cryptography but had private-key values below 256, when they should have been selected unpredictably from a much larger range—an attacker need
Key points
- Eight intermediate CA private keys generated with critically insufficient randomness, exploitable by testing minimal values.
- Six keys authorized for TLS certificate issuance; compromise could enable website impersonation attacks.
- Google Chrome blocked affected key hashes; Mozilla provided Firefox protections against domain spoofing.
- Flaw in key-generation process, not underlying cryptographic algorithm, exposed intermediate certificate authorities.
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. Analytics India Magazine did the reporting; read the original for the full story.
Read the full story at Analytics India Magazine
