Eight intermediate TLS certificates issued by India-based certificate authority eMudhra Limited were found to have private keys so weak that anyone could use them to mint trusted browser and app credentials for any internet server. The keys ranged from just 3 to 8 bits, a level of weakness that cryptography engineers describe as practically impossible for a functioning certificate authority.
Browser makers and some major apps and programming languages blocked all eight certificates by late Tuesday morning, according to Ars Technica. An informal advisory at emudhra.we-have-a-problem.com carried a message digitally signed with one of the compromised private keys, proving the reporting party had control of it. No certificate transparency logs yet show the keys being used maliciously, but the cleanup is expected to stretch for years.
eMudhra TLS certificates: how weak were the keys?
A standard NIST P-384 elliptic curve private key holds roughly 384 bits of entropy, a number with 116 digits of possible values. The eMudhra keys were measured at 4, 56, 66, 115, 155, 156, 230 and 237 bits, yet the company had described them as 3 to 8-bit keys. Cryptography engineer Filippo Valsorda called the situation “extremely in the ‘this should not be possible’ category.”
Because intermediate certificates can sign other certificates, anyone holding a compromised key could issue trusted credentials for banking sites, email providers or any other HTTPS service. Exploiting the flaw requires an active adversary-in-the-middle attack, meaning the attacker must position themselves between a user and the target server. VPN users, especially in countries where governments intercept traffic, face the most immediate risk.
- Eight intermediate certificates issued by eMudhra Limited were compromised.
- Private keys were 3 to 8 bits, far below the 384-bit norm for NIST P-384 keys.
