Compromised eMudhra intermediate certificates revoked after weak private key discovery

Cisco Talos reported that eight intermediate certificates belonging to the intermediate certificate authority eMudhra have been compromised. Rather than maintaining the required 384 bits of pseudo-random security, several associated private keys evaluated to single-digit and double-digit integers. This severe misconfiguration enables an attacker holding a compromised key to impersonate any website or service. [1]

Major software vendors moved quickly to block the affected certificates. According to Cisco Talos, Google Chrome, Mozilla, and Apple have already blocked six of the compromised TLS certificates. Microsoft has also blocked two additional certificates that were used for code signing. [1]

A certificate authority stores, signs, and issues digital certificates to certify the ownership of a public key. The entity acts as a trusted third party, allowing external users to rely on signatures or assertions linked to the corresponding private key under standards such as X.509 or EMV. [2]

Cisco Talos expects that additional security patches will become available across impacted platforms to fully mitigate the risk. [1]