Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
A security researcher discovered that certificate authority eMudhra used exceptionally weak elliptic-curve private keys (such as the number 4) for intermediate certificates. Major tech companies quickly moved to revoke trust and block the compromised certificates.
Why it matters
Exposes a catastrophic cryptographic failure in a major certificate authority, threatening the trust model of web security and necessitating rapid industry-wide patch deployment.
Security researcher, entrepreneur and international speaker who specialises in web technologies.
One of eMudhra's certificate authority private keys is the number 4.
Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their public certificates on my laptop just now, and it took less than a second.
On Saturday 17th October a security researcher reported to Apple, Google, Microsoft, Mozilla and eMudhra that the private keys for eight eMudhra intermediate certificates were compromised. Chrome pushed a CRLSet update blocking them that evening and Mozilla blocked them in Firefox via OneCRL a few hours later. On Tuesday 20th, Mozilla announced it publicly and shipped an NSS update removing the eMudhra root, and Chrome confirmed the root is going in Chrome Root Store v43.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in