Eight private keys underpinning part of listed digital trust company eMudhra’s certificate infrastructure were so weak that researchers could recover them from publicly available certificates. The discovery prompted Google, Mozilla, Apple, and Microsoft to block the affected certificates, triggering a wider effort to protect browsers, applications, and enterprise systems.

The incident also rattled investors. eMudhra shares hit their 20% lower circuit at ₹431.55 on the BSE today. 

The immediate concern is whether software still trusting the compromised keys could accept fraudulent certificates. A related challenge is replacing legitimate certificates affected by browser makers’ decision to withdraw trust in a parent certificate.

Here is what happened, how the flaw arose, and what it means for businesses.

Digital trust company eMudhra disclosed that eight of its digital certificate authorities had a serious security flaw after a researcher discovered that their private keys could be reconstructed from publicly available certificates.  

The keys were not stolen from eMudhra’s systems but instead generated using extremely small numbers that were easy to guess. The eight values were 4, 56, 66, 115, 155, 156, 230 and 237.

The discovery prompted major technology companies, including Google, Mozilla, Apple and Microsoft, to block or distrust the affected certificates. The incident has also raised concerns about the security of systems that rely on digital certificates to establish trust online.

BSE-listed eMudhra provides digital identity, authentication and security solutions to businesses, financial institutions and governments. Its services include digital signature certificates (DSCs), electronic signatures and tools that help organisations secure digital transactions and manage identities.

Source link