eMudhra Takes Remedial Action After Security Researcher Flags Weak Intermediate CA Keys

eMudhra, the India-based certificate authority (CA), has come under scrutiny after a researcher reported that its CA private keys are alarmingly weak. These weak keys have allowed researchers to compromise multiple certificates issued by the authority. eMudhra, which claims to have issued millions of certificates, has since sprung into action. It has started the replacement process for the weak keys. However, eMudhra also claims that none of the website certificates of its customers were issued using these weak keys. This incident has far-reaching consequences. Weak private keys can potentially allow bad actors to issue fake HTTPS certificates and illegitimately control the traffic of affected websites.

Following reports, eMudhra began taking remedial actions to minimise the damage. The company has also issued a clarification. The eight CA certificates were created in April last year as part of its Key Generation Ceremony within its public infrastructure, eMudhra pointed out. Further, the company assured that seven of the eight affected certificates were not deployed in production. The one certificate that was deployed has never been used to issue end-entity certificates.

On Wednesday, eMudhra informed that it had revoked the eight compromised CA intermediate certificates the day after the incident was reported. On top of this, the company says that its infrastructure remained uncompromised. It also claims that its data was not breached. Apart from the intermediate CA certificates being revoked, various root certificates were also distrusted by root programs. The company said, “No other roots or intermediates were generated using the flawed process.”

eMudhra has identified the flaw to be one of the steps during the Key Generation Ceremony, during which a key wrap/unwrap step produced a second set of private keys that were weaker. These were generated alongside the strong security keys, the company said. “The weak keys were the ones published to the browser root stores. The issue went undetected for about 18 months, through two independent audit cycles.”

On Monday, a member of Mozilla’s Cryptography Engineering team, Dennis Jackson, wrote that eight eMudhra intermediate CA certificates have been compromised. The CA certificates are used by the root programmes of Mozilla, Microsoft, Apple, and Chrome, among other firms. He said that the issue was first reported on October 17 to the Root Program Team wth the private keys of the eight CA certificates of eMudhra.

Later, security researcher Scott Helme cautioned that one of the CA private keys was the number “4”. He wrote, “Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just 4.” In other instances, the private keys were found to be 56 and 115, which are considered to be significantly weak. The researcher was able to recover these CA keys from eMudhra’s public certificates using his laptop in “less than a second”.