EMudhra

India has opened a special investigation into certificate authority eMudhra after eight intermediate CA private keys were found to be trivially recoverable. CERT-In and Red Hat have issued fresh security alerts, and the fallout is said to extend beyond Chrome, Firefox, and Go. The incident raises concerns about the integrity of digitally signed certificates issued under the compromised keys.

Security researcher Scott Helme reports that eMudhra, an Indian certificate authority, used cryptographic keys with only eight bits of effective entropy, allowing them to be factored and cracked in milliseconds. The finding raises questions about how such weak keys passed audits and whether certificates issued under them can be trusted, prompting discussion among security professionals about oversight of root programs.

Eight TLS certificates issued by India-based certificate authority eMudhra were found to have extremely weak private keys, raising fears that attackers could impersonate virtually any website. Security researchers are highlighting the finding as a serious internet-wide risk, and discussions are focused on how such weak keys were allowed into issuance and what revocation steps may follow.

Security researchers report that certificates issued by Indian certificate authority eMudhra include some private keys generated with unusually small parameters, in extreme cases values as tiny as 4, making them trivially factorable. The flaw raises concerns about the strength of digital signatures and encrypted connections relying on those certificates. Commenters are questioning how such weak keys passed validation and whether affected certificates will be revoked.

Security researchers report that certificates issued by Indian certificate authority eMudhra were generated with extremely small private keys, in some cases numbers as small as 4, making them trivially easy to crack. The flaw has drawn attention from the cryptography community, with experts questioning how such weak key generation passed validation checks and urging affected users to check their certificates.

Security researcher Scott Helme reports that eMudhra, an Indian certificate authority, issued TLS certificates with dangerously weak RSA keys that could be factored in milliseconds, effectively amounting to only about eight bits of security. The flaw raises concerns that attackers could have forged trusted certificates for any website, undermining the integrity of HTTPS validation.

A cryptographic weakness linked to eMudhra, a certificate authority, reportedly allowed digital keys so predictable they could be as weak as the number 4. Researchers warn that poorly generated encryption keys of this kind can let attackers decrypt protected communications or forge digital signatures. eMudhra issues digital certificates used for secure websites and document signing, so flaws at that level raise concerns across services relying on its certificates.

Eight certificate authority keys belonging to Indian digital security firm eMudhra have been compromised, prompting emergency fixes across major browsers and software platforms. The breach affects root and intermediate certificates used to verify secure connections, and vendors are rushing to remove or replace the affected trust entries to protect users from potentially forged certificates.

Indian certification authority eMudhra is under scrutiny after reports that some of its private signing keys were compromised, with one reportedly protected by the extraordinarily weak password '4'. The story, covered by The Register, is drawing attention across multiple countries, with search interest rising in India, the UK, Germany, Japan and Canada. Commenters are questioning how a company responsible for issuing digital certificates could secure critical keys so poorly.

Indian certification authority eMudhra has disclosed that some of its private keys were compromised, including one key that was effectively the number '4'. The incident affects certificates the company issues, and security reporters are highlighting the unusually weak key as a sign of poor key-generation practices. Customers and browser vendors are now assessing which certificates need replacing and what the broader trust implications are.

Security researcher Harry Sintonen reports that eMudhra's certificate authority can be dropped directly into mitmproxy, allowing fully trusted TLS man-in-the-middle interception without generating a custom certificate. Because the CA is trusted by default in many environments, traffic interception can go undetected, raising concerns about the certificate authority's handling and trustworthiness.

Indian certification authority eMudhra has had private keys compromised, including an underlying value that was simply the number '4'. The flaw could allow attackers to impersonate any website or service trusted by the authority, and a large-scale revocation and clean-up effort is now under way. Security commentators are highlighting how such a weak key value could have been accepted, raising questions about the company's key generation practices.

Indian certification authority eMudhra has reportedly had its private keys compromised, with one of the exposed keys being trivially weak — the number '4'. Security outlets report a massive clean-up is under way, because the breach could allow attackers to impersonate any website or service that trusted eMudhra's certificates, forcing widespread certificate revocations.

Eight certificate authority keys belonging to Indian digital security firm eMudhra have been compromised, prompting emergency responses from browser makers and software vendors worldwide. The affected keys were revoked and trust stores are being updated to remove them. The incident raises concerns about the integrity of secure web connections relying on eMudhra-issued certificates, though no confirmed exploitation has been reported so far.

The private keys of Indian certification authority eMudhra have been compromised, and one of the keys was reportedly protected by the single-digit password '4'. The Register reports on the security lapse, which raises serious questions about the firm's key management practices and the trustworthiness of certificates it has issued. Commenters are debating how such weak protection could occur and what the fallout may be for browsers and certificate authorities.

eMudhra, a major certificate authority, is under scrutiny after eight of its intermediate TLS certificates were found to be compromised and are now being blocked by major web browsers. The move affects HTTPS trust chains issued through the affected intermediates. The story is drawing attention in Germany, India, Canada and Japan as site operators check whether their certificates are impacted.

A claimed compromise of eMudhra's intermediate certificate authority is circulating among cryptography and security communities. The report was shared alongside a sarcastic programming joke about a random number generator returning a fixed value, implying weak or predictable randomness may have played a role. eMudhra, a certificate authority based in India, has not been confirmed as issuing an official statement in the available discussion.

Digital trust services firm eMudhra has reportedly suffered a security breach, prompting coverage of what it means for smartphone and internet users. eMudhra provides digital certificates and encryption services widely used for secure online transactions in India, so concerns centre on whether customer data or certificate integrity was affected. Details on the scale and impact of the incident remain limited.

Eight private keys belonging to Indian certificate authority eMudhra have reportedly been cracked, prompting alarm online over what this could mean for the security of websites and digital certificates signed with them. Compromised certificate authority keys would undermine trust in encrypted connections, though the full scope of the incident and any real-world impact remain unclear.

Security researchers have identified eight certificates issued by Indian certificate authority eMudhra Limited that could have been used to forge credentials and impersonate trusted websites. The flaw potentially allowed man-in-the-middle attacks, letting attackers intercept SSL/TLS traffic between users and legitimate services. The discovery renews scrutiny of certificate authorities and their role in web trust.

Security researcher Scott Helme reports that eMudhra, an Indian certificate authority, issued TLS certificates protected by cryptographic keys so weak they could be cracked in milliseconds, in a piece titled 'Eight Bits of Trust'. The finding raises questions about how such certificates passed CA validation checks and renews concern over oversight in the public key infrastructure ecosystem.

A report circulating in tech circles claims that eMudhra, the India-based certificate authority, has suffered a compromise of one of its intermediate certificate authorities. A dedicated site titled 'we-have-a-problem' lays out the alleged incident, and the story is drawing attention on developer forums. Details remain sparse, and eMudhra has not yet been confirmed as having publicly commented on the scope or validity of the claim.

The private keys of eight eMudhra intermediate certificate authority certificates have been compromised, with Mozilla and Google's Chrome Root Program confirming the incident on October 20. Certificate authorities sit at the root of web encryption, so compromised intermediates could allow attackers to forge trusted HTTPS certificates. The news is circulating among security commentators amid wider worries about the fragility of the internet's trust infrastructure.

India's licensed certification authority eMudhra has had private keys compromised, and one of them was simply the number 4, according to The Register. Commenters are mocking the lapse, noting a bike lock offers better protection, and warning that poorly secured signing keys from a trusted certificate authority undermine the security guarantees the entire web relies on.

Indian certificate authority eMudhra is under scrutiny after reports that its private keys were compromised, with one of the exposed keys reportedly being simply the number 4. Security experts are mocking the company's key management practices, and the '4' jokes have spread widely across the infosec community as a symbol of how easily the keys could be guessed.