PolicyCyber security
MeitY opens probe into eMudhra certificate keys as CERT-In issues advisory
The certifying authority says a flaw generated weak cryptographic keys in a small part of its international business. Its Indian digital signature and eSign services are said to be unaffected.
Key points
- eMudhra reported that private keys of eight intermediate certificates in its PKI were compromised.
- Six were TLS certificates for websites and two were code-signing certificates.
- The company says the affected business brings in about 1% of its revenue and no customer data was exposed.
The Ministry of Electronics and Information Technology (MeitY) has opened an investigation into a security lapse at the digital certificate firm eMudhra, and the Indian Computer Emergency Response Team (CERT-In) issued a mitigation advisory on Wednesday.
eMudhra has reported that the private keys tied to eight intermediate certification authority certificates within its public key infrastructure were compromised. Six of them were TLS certificates, the kind that secure connections to websites, and two were code-signing certificates, which vouch that software comes from a trusted publisher.
What went wrong
The company said a flaw in its system produced weak cryptographic keys alongside the strong ones it meant to create. A researcher alerted Apple, Google, Microsoft and Mozilla that the weak keys could potentially be worked out, including with AI-assisted techniques.
Security experts say compromised TLS keys could let an attacker issue fraudulent certificates for domains they do not control, impersonate genuine websites, and intercept or alter encrypted traffic. Code-signing keys could be misused to pass off malicious software as coming from a trusted source.
eMudhra said its infrastructure was not breached, no customer data was compromised and its physical and logical security controls remain intact. The problem, it said, was confined to a small part of its international TLS certificate business, which accounts for about 1% of its revenue, and did not touch its domestic digital signature operations.
Government view
Officials were reported to have said the impact on Indian websites and apps was limited and temporary, and that eMudhra’s India-regulated Digital Signature Certificate and eSign services were not affected. They cautioned against exaggerated claims on social media and said the ministry was also checking with other certificate operators. More details are expected once the investigation is complete.