Scott Helme

Security researcher Scott Helme has published an analysis alleging that weak, effectively eight-bit entropy keys associated with Indian certificate authority eMudhra could be cracked in milliseconds, raising questions about the trustworthiness of certificates the company has issued. The findings are being widely discussed among security professionals, with debate over the implications for browser and operating system trust stores and whether the authority should face removal or audit.

Security researcher Scott Helme reports that eMudhra, an Indian certificate authority, issued TLS certificates protected by cryptographic keys so weak they could be cracked in milliseconds, in a piece titled 'Eight Bits of Trust'. The finding raises questions about how such certificates passed CA validation checks and renews concern over oversight in the public key infrastructure ecosystem.