Digital trust company eMudhra has appointed KPMG to conduct an independent review of the security incident involving the generation of weak private keys linked to eight intermediate digital certificate authorities, the company said on Friday, October 30.

The appointment follows the company's earlier commitment to bring in an independent external expert to examine the incident, which exposed a vulnerability in its global digital certificate infrastructure and triggered scrutiny from cybersecurity experts, regulators and major technology companies.

In a communication on Friday, eMudhra said, "Regarding the reported incident, wherein we had stated our commitment to appoint an independent external reviewer, we wish to inform you that the Company has appointed KPMG to undertake an independent review of the matter."

The review comes days after the company faced questions over its handling of the incident, including concerns about the security of its certificate infrastructure, the time taken to respond to queries and the potential implications for internet security.

The security incident has also weighed on investor sentiment. Over the past 10 days, eMudhra shares have shed nearly 20%, falling from ₹432 at the October 21 close to ₹346 at the October 29 opening, as the security lapse put the company under investor scrutiny.

The issue first came to light on October 17, when a security researcher known as Wayne reported that private keys associated with eight intermediate Certificate Authority (CA) certificates issued by eMudhra could be recovered. The keys had an effective key space of just three to eight bits, making them highly vulnerable to guessing and recovery.

Source link