Indian CA eMudhra suffers private key compromise in intermediate certificates

Eight intermediate certificate authority private keys belonging to Indian certificate authority eMudhra Limited have been compromised. Schneier on Security and Unit 42 both report that the incident stems from weak private keys. Cyber Kendra reports that eMudhra is quitting the global TLS certificate business following the compromise. [1][2][4]

Unit 42 reports that the private keys were generated with insufficient randomness during the certificate generation process. This cryptographic defect allows potential attackers to derive the private keys directly from public certificates. Unit 42 notes that the compromised intermediate keys create risks of unauthorized Transport Layer Security signing and man in the middle interception. [1][2]

Schneier on Security reports that a standard NIST P-384 elliptic curve cryptography private key contains approximately 384 bits of entropy. Schneier on Security notes that the eMudhra keys suffered from a severe defect that left them with weak private keys. [1]

Major browser and operating system vendors have moved to mitigate the impact. Unit 42 reports that vendors are taking action following the discovery of the compromised intermediate certificate authority keys. [2]