Former CERT-In director-general and India's first National Cyber Security Coordinator Gulshan Rai has called for an audit of eMudhra's Indian operations following a security lapse involving the company's global digital certificate business. He has also called for the company's licence to be suspended until the audit is completed.

Rai said eMudhra's domestic operations needed to be scrutinised given the company's close involvement with key digital services, including Aadhaar, income tax filing, Goods and Services Tax (GST) filing and Registrar of Companies (ROC) filings.

“Given what we have seen with eMudhra's global business, they must be audited and scrutinised for their Indian operations,” Rai said. He added that the company's licence should be suspended until the audit is completed.

His remarks come after India's cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), issued an advisory on October 21 regarding a security compromise involving eight intermediate digital certificate authorities linked to eMudhra.

According to CERT-In, private cryptographic keys associated with the eight intermediate certificate authorities had been generated with insufficient randomness, making them vulnerable to recovery.

The compromised keys could potentially allow attackers to create fraudulent website security certificates, impersonate legitimate websites and interfere with encrypted internet communications.

The issue came to light on October 17, when a security researcher reported that the affected certificates had private keys with an extremely small effective key space, making them vulnerable to being guessed almost instantly.

Following the discovery, major browser providers, including Google, Mozilla and Apple, moved to block or distrust the affected certificates.

Source link