The eMudhra incident is a trust problem, not a browser problem
By Darren Meyer, Research Advocate, Checkmarx
Browser maintainers acted within hours of the eMudhra report. That is the good news, but it could lead some security teams to wrongly consider the matter closed.
What happened
On October 17, a researcher using the handle “Wayne” reported to the browser root programs that the private keys of eight eMudhra intermediate CA certificates had been compromised, and proved it by signing messages with each key. According to Google, the cause was weak entropy at generation. Every affected key was just one byte. Anyone could recover a private key from the public CA certificate by generating the first 256 P-384 keys and comparing. That meant anyone could forge HTTPS certificates for any website or application; clients that still trusted these CAs would accept them.
eMudhra says the problem is confined to eight intermediates from an April 2025 key ceremony and that none issued an...
Copyright of this story solely belongs to www.expresscomputer.in. To see the full text click HERE
