eMudhra's apology over the compromise of private keys associated with eight intermediate certificate authorities has raised questions about its security checks and the effectiveness of its audits. The company said it revoked the affected certificates within 14 hours of confirming the issue, but the failure to detect the weak keys during two rounds of audits remains a key concern.

In an interview with CNBC-TV18, cyber security expert Ritesh Bhatia welcomed the company's response but said a detailed investigation was needed to establish how the flaw occurred. He also called for scrutiny of its other operations, arguing that the incident had implications for trust in digital certificates beyond the company itself.

eMudhra acknowledged a flaw in its key-generation process that resulted in weak cryptographic keys associated with eight intermediate certificate authorities.

Bhatia said the numbers generated for the keys were far smaller than expected. He cited examples such as 4, 111 and 157, saying the values were single-digit, two-digit or three-digit numbers instead of the approximately 115-digit values he expected.

What concerned him most was that the weakness had not been identified during two rounds of audits.

"In fact, I am pretty disappointed about one particular thing, which is that there were two cycles of audits, and yet the auditors or even the company couldn't find out" that the keys were so weak, Bhatia said.

The failure raises questions about how the key-generation process was checked and why the existing safeguards did not flag the problem before it came to light.

Source link