Eight web security keys of eMudhra firm used by Govt. and PSUs leaked

Eight private security keys used for web certificates by Bengaluru-based eMudhra Ltd. have been exposed, prompting security teams at major tech companies to scramble to address the vulnerability. The leak occurred as several government websites, including UIDAI and the income tax portal, relied on eMudhra’s keys to sign their security certificates, which are crucial for websites to function correctly in modern browsers.

These intermediate certificate keys had a critical flaw: instead of a 384-bit private key, they contained a numerical key between 1 and 256, making them far simpler to decipher. One of the keys was as low as the number 4, preceded by 383 zeroes. Dennis Jackson, involved in Mozilla’s response, noted that eMudhra’s keys were "trivial to exploit."

Six of the impacted certificates, used for Transport Layer Security (TLS), were trusted by Chrome, Mozilla, Microsoft, and Apple. eMudhra promptly revoked the affected certificates and began collaborating with browser and root-store operators to protect users and maintain web security. The flaw stemmed from a "Key Generation Ceremony" error that produced weak keys alongside the original strong ones.

While none of the affected intermediate CAs were deployed in production or had issued end-entity certificates, eMudhra acknowledged a "wrap/unwrap" step error during key generation. The company is investigating the root cause. Cybersecurity expert Yash Kakadia warned that even if the browsers are patched, the impact could extend to IoT devices, which may not receive frequent updates. As of now, eMudhra's root certificates, which are trusted globally, remain uncompromised.