Compromised TLS Certificates
Indian CA eMudhra issued eight TLS certificates with catastrophically weak P-384 private keys, raising fundamental questions about CA audit effectiveness and the reliability of the WebPKI trust model.
Summary written by editorial AI · Source link below
The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys : The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2 384 , or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Aston
Editorial Analysis
Framed for the DevSecOps Engineer desk
Applications and services pinning or trusting eMudhra certificates could be vulnerable to interception if the weak keys are exploited.
Audit application trust stores and certificate pinning configurations for eMudhra CA presence and prepare for revocation.
A certificate authority issued TLS certificates with effectively broken cryptography, threatening the trust model that secures internet communications.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Schneier on Security in a new tab.
More from the Vulnerabilities Desk
- Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers1d
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software2d
- Abandoned Popcorn Time app exposed millions of devices to RCE attacks3d
- HPE patches eight max severity RCE and auth bypass AOS flaws3d
- [NEU] [hoch] Oracle Java SE and GraalVM, und OpenJDK: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen3d