🔒eMudhra CA Keys Compromised, Affecting Millions of Certificates
Millions of Certificates Now Vulnerable to MITM Attacks
TL;DR
Private keys for eMudhra's intermediate CAs have been compromised, affecting millions of TLS and code-signing certificates. Browsers blocked the affected CAs, but other software remains vulnerable. Developers must update their systems to avoid MITM attacks.
Private keys for eight eMudhra intermediate Certificate Authority (CA) certificates have been compromised, impacting millions of TLS and code-signing certificates. Browsers were able to block the affected CAs using their background revocation blocklists, but many other software systems lack similar mechanisms, leaving them vulnerable to man-in-the-middle (MITM) attacks. The compromised certificates were trusted by major root programs like Apple, Chrome, Microsoft, and Mozilla, making this a significant security issue for developers and system administrators. The compromised keys were all zero except for the final byte, which was 4, 56, 66, 115, 155, 156, 230, or 237, making them trivially enumerable and their public keys easily inferred. This incident highlights the importance of robust key generation and the need for more widespread adoption of Certificate Transparency and post-quantum cryptography.
Key Points
Private keys for eight eMudhra intermediate CAs compromised, affecting six TLS certificates and two code-signing certificates.
Compromised certificates trusted by Apple, Chrome, Microsoft, and Mozilla root programs, impacting millions of users.
Browsers blocked affected CAs using background revocation blocklists, but other software lacks similar mechanisms.
Compromised keys were all zero except for the final byte, which was 4, 56, 66, 115, 155, 156, 230, or 237.
Certificate Transparency and post-quantum cryptography could help prevent such compromises in the future.
Why It Matters
If you're using any software that relies on web PKI, this affects you. The compromised CA keys mean that any unpatched system is vulnerable to MITM attacks. Developers and system administrators need to update their systems to avoid potential security breaches. This highlights the importance of robust key generation and the need for more widespread adoption of Certificate Transparency and post-quantum cryptography.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,569 builders reading daily.