Weak eMudhra keys expose eight trusted intermediate certificates
All eight P-384 private keys were integers below 256 and could be recovered from public certificate data.
6
Stories per day · 30 days
5 stories, newest first · one card per story
Stories tagged #revocation
Mitigation posted for the eMudhra intermediate CA compromise
Systems that do not receive CRL updates are told to disable emSign ECC Root CA - G3 and the Comodo AAA Services root.
Authorization Revocation for Long-Running AI Agents: Root-Scoped Quiescence under Delegation and Asynchronous Execution
A root-scoped quiescence protocol revokes authorization for long-running AI agents across delegation, queues, and late effects.
This Key Will Self-Destruct: An Open Standard for Revocable API Keys
SecurityWeek opinion piece proposes ORKS, an open standard adding issuer prefixes, discovery files, and unauthenticated revocation endpoints to make leaked API keys quickly revocable.
Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems
An empirical study finds no major agent-memory system enforces fact revocation at retrieval, causing agents to act on superseded, unsafe information.