A company that vouches for websites had secret keys so weak that 8 of them were cracked
Eight secret keys at eMudhra, an Indian firm that vouches for websites, were compromised. Browsers and software makers are rushing out fixes.
Make preferred on
Share this article
Summary
- Eight private keys belonging to Indian certificate authority eMudhra were compromised, potentially allowing attackers to forge certificates and impersonate trusted websites.
- Major browser makers quickly blocked the certificates, and no attacks have been reported, but some nonbrowser software may remain vulnerable because it does not check whether certificates have been revoked.
- Researchers said eMudhra used easily guessed integers as private keys, enabling all eight to be recovered from public certificates in under a second.
