eMudhra’s Security Key Flaw: What Went Wrong And Why Google, Mozilla Stepped In
eMudhra disclosed that eight of its digital certificate authorities used extremely weak private key values (4, 56, 66, 115, 155, 156, 230, 237) that were easily guessable from publicly available certificates. The private keys were not stolen but rather generated using inadequate randomization. Major browser and platform vendors responded by revoking trust in the affected certificates to prevent fraudulent certificate acceptance. The incident also impacted investor confidence, with eMudhra shares hitting their 20% lower circuit limit on the BSE.
Key points
- Eight certificate authorities generated private keys from predictable small numbers.
- Google, Mozilla, Apple and Microsoft blocked affected certificates.
- Risk of compromised systems accepting fraudulent certificates.
- eMudhra shares declined to 20% lower circuit at ₹431.55 on BSE.
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. Inc42 did the reporting; read the original for the full story.
Read the full story at Inc42
