The Sampadak Express News Desk
Eight private keys used by Bengaluru-based digital certificate authority eMudhra Ltd. to issue web security certificates have been exposed, prompting major browser and operating system vendors to move quickly to stop trusting the affected certificates, according to reporting by The Hindu. The incident has raised concerns because a range of government websites rely on eMudhra-issued certificates.
The compromised keys were for intermediate certificate authorities — the tier that signs website certificates — and contained a basic cryptographic flaw disclosed by an anonymous researcher who alerted internet infrastructure firms in recent days. Instead of the expected 384-bit private keys, the intermediates were assigned simple numerical values between 1 and 256, making them trivially guessable. In one instance, the private key was effectively the number 4 prefixed by 383 zeroes.
The Ministry of Electronics and Information Technology (MeitY) said it has “taken serious note of the reported incident” and formed a special team to investigate. The Ministry added that the impact on Indian websites and applications was “very limited and for a very short interval,” and stressed that Digital Signature Certificates and eSign services regulated by the Controller of Certifying Authorities (CCA) remain unaffected. MeitY also noted it was not involved in auditing this portion of eMudhra’s operations and cautioned against “fear mongering” on social media.
Dennis Jackson, involved in Mozilla’s response to the exposure, said the private keys were “trivial to exploit,” and that six of the impacted certificates were for TLS and trusted by the Chrome, Mozilla, Microsoft and Apple root programs. eMudhra has revoked the affected certificates.
“Upon becoming aware of the incident, eMudhra initiated its incident response procedures, took measures to contain the affected certificates, and began working closely with browser and root-store operators to safeguard users and maintain the integrity of the broader WebPKI ecosystem,” the company said in an update on its website. It added that none of the affected intermediate certificate authorities (CAs) issued any end-entity (website) certificates, and said this has been confirmed through internal analysis and public Certificate Transparency logs. Only one of the affected intermediates had been deployed in production, the firm said without identifying it.
In a subsequent filing to stock exchanges, eMudhra attributed the problem to its Key Generation Ceremony, saying a wrap/unwrap step “produced a second set of weak keys alongside the original strong keys.” The company said the “weak keys were the ones published to the browser root stores” and that it is working to determine the root cause.
Security practitioners warned, however, that even when browsers and operating systems remove trust in the affected intermediates, some devices may remain at risk. “The cleanup could be enormous, particularly for devices and software that cannot be easily updated,” said Yash Kakadia, founder of cybersecurity firm Security Brigade, pointing to potential implications for internet-of-things (IoT) hardware that receives infrequent updates.
Several high-profile Indian government services, including the Aadhaar issuer UIDAI and the income tax e-filing portal, use eMudhra certificates or other technology from the company. There is no indication that eMudhra’s root certificates — which sit above the compromised tier — have been affected.
eMudhra is currently the only Indian root certificate authority trusted by major global browsers. Browser makers have historically been cautious about trusting Indian CAs following the issuance of “rogue” certificates by the National Informatics Centre’s root authority in July 2014.
As part of a broader push to shape the country’s web trust landscape, MeitY in 2023 launched the Indian Web Browser Development Challenge to encourage development of a domestically made browser that would trust CCA-approved roots, which mainstream browsers presently block. Zoho Corporation’s Ulaa won the challenge, receiving a ₹1 crore award.
MeitY’s special team has begun an investigation into the eMudhra exposure, while the company continues coordinating with browser and root-store operators and says it is working to establish the precise root cause.
