Eight private cryptographic keys connected with digital certificates issued by Indian digital trust company eMudhra have been compromised in last few days, thus igniting concerns about internet security and the risk of website impersonation. The incident has compelled big browser and software providers, including Google, Mozilla, Apple and Microsoft, to block the impacted certificates.
According to reports on October 21, the compromised keys were generated with insufficient randomness, thus making them vulnerable to recovery. Security researchers also cautioned that the weakness could permit attackers to create fraudulent certificates and impersonate legitimate websites on systems that persisted to trust the impacted certificates.
However, there is no confirmed public proof that the compromised keys were utilised to conduct attacks.
What is eMudhra?
eMudhra is an Indian digital trust company and a licensed Certifying Authority under the Information Technology Act, 2000. It provides Digital Signature Certificates, electronic signing solutions, digital identity services and website security certificates.
Certifying Authorities play a crucial role in developing trust online. They issue digital certificates that help browsers verify website identities and create encrypted connections. These certificates also promote electronic authentication and digitally signed software.
Related Stories
How were the eMudhra certificates keys compromised?
According to cybersecurity reports, the eight affected private keys were generated using an insufficient randomness. Cryptographic keys must be unpredictable and sufficiently complex to prevent unauthorised recovery.
Here, researchers showcased that the private keys could be recovered because the key-generation process was weak. The vulnerability did not caused a failure of the underlying cryptographic algorithm itself.
Of the eight affected intermediate certificates, six were authorised to issue Transport Layer Security (TLS) certificates for websites, while two were targetted for code signing.
If misused, the compromised keys could enable attackers to forge fraudulent certificates that make fake websites appear legitimate to systems that still validate them. Thus, consequently enabling interception or alteration of communications.
What action have companies undertaken against compromised eMudhra certificate?
Google Chrome and Mozilla Firefox blocked the affected certificates after the issue was reported on October 17. Apple, Microsoft and other technology firms also took protective actions.
These moves are aimed at preventing browsers and supported applications from trusting certificates linked with the compromised keys. However, some software may need updates because certificate-revocation protections are not executed uniformly across applications.
What does eMudhra say?
In its October 20 statement, eMudhra asserted that it was investigating the incident and cooperating with browser and software companies.
The company stated that only one of the eight affected intermediate certificates had been fielded in production, and none had issued end-entity certificates. It also stated that its root certification authority's private keys and other intermediate certificates were not impacted.
The investigation still remains ongoing.