Eight security keys leaked

Eight private keys used by Bengaluru-headquartered eMudhra Ltd to issue web security certificates have been leaked, prompting browser and operating system developers worldwide to patch systems.

Government websites affected

Several government websites use eMudhra's keys to sign security certificates, including those for Aadhaar issuer UIDAI and the income tax filing portal, which are necessary for display on modern browsers.

Keys were dangerously weak

Instead of using 384-bit private keys, the intermediate certificates had numerical keys between one and two hundred fifty-six, making them orders of magnitude easier to infer. One key was just the number four.

“One of the keys was just the number 4, preceded by 383 zeroes.”

Ministry launches investigation

The Ministry of Electronics and Information Technology said it has taken serious note of the incident and constituted a special team to investigate. The ministry said the impact on Indian websites was very limited.

Mozilla researcher confirms severity

Dennis Jackson, involved in Mozilla's response, said eMudhra's private keys were trivial to exploit. Six of the impacted certificates are for TLS and trusted by Chrome, Mozilla, Microsoft and Apple root programs.

“trivial to exploit”

eMudhra revokes certificates

eMudhra revoked the affected certificates and said it initiated incident response procedures. The firm said none of the affected intermediate certificate authorities were deployed in production except one.

Root cause identified

eMudhra said a flaw in the key generation ceremony caused a wrap or unwrap step to produce a second set of weak keys alongside the original strong keys.

IoT devices pose cleanup risk

Yash Kakadia, founder of Security Brigade cybersecurity firm, said the impact could extend to internet-of-things devices not frequently patched. The cleanup could be enormous for devices that cannot be easily updated.

“The cleanup could be enormous, particularly for devices and software that cannot be easily updated.”

Root certificates remain secure

There is no indication that eMudhra's root certificates, which sit above the tier that was leaked, have been compromised. eMudhra is the sole Indian root certificate authority trusted globally by browsers.

India pushes for homegrown browser

In twenty twenty-three, MeitY launched the Indian Web Browser Development Challenge to develop an Indian-made browser that would trust root certificate authorities by the CCA. Zoho Corp's Ulaa won, receiving one crore rupees.