Compromised TLS Certificates
Indian CA eMudhra issued eight TLS certificates with catastrophically weak P-384 private keys, raising fundamental questions about CA audit effectiveness and the reliability of the WebPKI trust model.
Summary written by editorial AI · Source link below
The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys : The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2 384 , or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Aston
Editorial Analysis
A public CA producing trivially factorable keys exposes every relying party to interception; this is a systemic WebPKI trust failure, not an isolated incident.
Check enterprise trust stores for eMudhra root and intermediate certificates; prepare to distrust them if browser vendors initiate revocation.
A certificate authority issued TLS certificates with effectively broken cryptography, threatening the trust model that secures internet communications.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Schneier on Security in a new tab.
More from the Vulnerabilities Desk
- Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers1d
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software2d
- Abandoned Popcorn Time app exposed millions of devices to RCE attacks3d
- HPE patches eight max severity RCE and auth bypass AOS flaws3d
- [NEU] [hoch] Oracle Java SE and GraalVM, und OpenJDK: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen3d