oss-security reply praises handling of eMudhra intermediate compromise
Original title: Re: eMudhra Intermediates Compromise
The note suggests other CA root and intermediate keys should be checked for weak private keys.
On oss-security, Solar Designer thanked Dennis for handling the eMudhra intermediates compromise and said the decisions appear well reasoned. The reply points to a suggestion that other certificate-authority root and intermediate keys be audited for potentially weak private keys, comparing the situation with earlier audits of PGP RSA keys. The message does not describe the compromise itself.
Unconfirmed: This snippet does not confirm which certificates, keys, or relying parties were affected.
- The post is an October 21 reply, not a new technical disclosure.
- It expresses surprise that CA keys were not already audited like many PGP RSA keys.
Impact: Possible weak private keys on CA certificates
From the original article
Posted by Solar Designer on Oct 21 Thank you Dennis for handling this so well, we can now see that all of your decisions were indeed well-reasoned. This is an interesting read, especially this part: I guess all other keys corresponding to CA root and intermediate certs will now be audited for having potentially weak private keys.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.