Security teams worldwide activated heightened alert status Tuesday following the disclosure of eight intermediate TLS certificates belonging to eMudhra Limited, an India-based certificate authority. The certificates contained private keys with critically insufficient entropy levels, potentially enabling unauthorized parties to generate trusted credentials for any internet server. The weakness in the keys ranged from 3 to 8 bits of entropy, dramatically below the normal 384 bits expected for NIST P-384 elliptic curve cryptography keys, with specific instances measuring 4, 56, 66, 115, 155, 156, 230, and 237 bits.
News of the vulnerability spread through an informal advisory posted to a dedicated website Tuesday, digitally signed with one of the compromised private keys as proof. By late morning Tuesday, major browser developers and several prominent applications and programming languages had moved to block all eight certificates. Certificate transparency logs, which maintain records of all browser-trusted certificate issuances, had not yet documented malicious use of the compromised keys as of the reporting time. However, security experts cautioned that the threat remained substantial due to the extensive effort required to revoke and update certificates across the broader internet ecosystem.
Cryptography specialist Filippo Valsorda compared the cleanup operation to the 2014 Heartbleed vulnerability, noting that recovery would prove particularly challenging due to the diversity of affected systems including Linux distributions, Internet of Things devices, Docker containers, and embedded systems. He emphasized that coordination across numerous organizations and technical contexts would significantly extend remediation timelines. Most mainstream browsers had already implemented blocking measures, with the notable exception of Microsoft Edge running on Windows 10, which was still connecting to vulnerable hosts at the time of reporting.
Security analysts noted that exploitation would require active man-in-the-middle attacks, limiting the threat to sophisticated adversaries or individuals with network access at locations such as coffee shops or universities. Applications including Signal, WhatsApp, and Wireguard that do not depend on TLS for encryption were unaffected. The incident highlighted structural vulnerabilities in the TLS certificate ecosystem, where security depends on all participating certificate authorities maintaining proper standards. eMudhra representatives were not immediately available for comment.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI