Eight private keys used to issue web security certificates by Bengaluru-headquartered eMudhra Ltd. have been leaked, sending security teams at major internet browser and operating system developers around the world scrambling to patch their systems to stop trusting the affected certificates.
Public key cryptography, such as that used in web security certificates, or SSL certificates, relies on private keys staying unknown to any outside entities under all circumstances. The uncovered flaw boiled down to this: instead of using a 384-bit private key, these intermediate certificates just had a numerical key that was between 1 and 256, making it orders of magnitude easier to infer them. One of the keys was just the number 4.
The extraordinary development comes as several government websites use a range of eMudhra’s keys to “sign” their security certificates, which is practically necessary for any website to display on a modern browser. These “intermediate” security certificate keys had a glaring flaw, according to an anonymous researcher who alerted major internet infrastructure firms over the last few days.
This has been confirmed through our internal analysis and corroborated by publicly available Certificate Transparency records.” “Furthermore, none of these intermediate CAs, including the one deployed in production, have issued any end-entity certificates.
“Importantly, none of the affected intermediate CAs were deployed in production, with the exception of one,” eMudhra said, without identifying which one it was.
