eMudhra exits global TLS business after weak certificate keys
Original title: Disgraced eMudhra drops out of TLS business following certificate debacle
Eight intermediates used 3- to 8-bit private keys that could be cracked in milliseconds to mint trusted certificates.
India-based eMudhra Limited said it will withdraw from global SSL/TLS after researchers found eight intermediate certificates with defective private keys. Chairman V. Srinivasan cited compliance costs, revenue of 1 percent, and free certificate providers. The company said social-media scrutiny was out of proportion to that business. NIST P-384 keys should hold about 384 bits of entropy; these ranged from 3 to 8 bits.
Unconfirmed: The company did not say whether anyone used the weak keys to issue fraudulent certificates.
- The eight private keys were 4, 56, 66, 115, 155, 156, 230 and 237.
- The strongest defective key had at most 256 possibilities.
- The Thursday announcement came two days after the research disclosure.
- Forged certificates could be trusted by major browsers and many mail servers.
Impact: forge trusted TLS certificates for websites or mail servers
| Product | Affected |
|---|---|
| eMudhra TLS intermediate certificates | eight intermediates with 3- to 8-bit keys |
- 1.Treat the eight defective eMudhra intermediates as untrustworthy for TLS.
- Vendors
- eMudhra Limited
- Products
- TLS certificates
- Countries
- India
From the original article
1 min read at arstechnica.com
Flubbed key signing "ceremony" allowed minting of Web credentials for any site.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.