eMudhra, an India-based certificate authority, has announced its exit from the TLS certificate business following a significant security breach involving the issuance of eight certificates with alarmingly weak private keys. The compromised keys, some as weak as 4 bits, allowed for the easy generation of trusted certificates for any website or mail server, raising serious concerns about the integrity of the certificates issued by the company.
V. Srinivasan, chairman of eMudhra Limited, attributed the decision to increasing compliance costs and the minimal revenue generated from the TLS business, which accounted for only 1 percent of the company’s overall income. He noted that the rise of organizations offering free TLS certificates further diminished the business’s viability. “The level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,” eMudhra stated in a recent post, indicating that the board concluded withdrawing from the TLS market was the best course of action for the company and its shareholders.
Security Breach Details
The announcement follows revelations by researchers that eMudhra had issued certificates with private keys so weak they could be cracked in mere milliseconds. The compromised keys, which should have adhered to NIST P-384 elliptic curve cryptography standards, exhibited key sizes ranging from 3 to 8 bits, far below the expected 384 bits of entropy. This vulnerability allowed anyone with minimal effort to generate TLS certificates that would be trusted by major browsers and various email servers, IoT devices, and other systems relying on these certificates.
While the strongest of the defective keys had a maximum of just 256 possible combinations, the implications of this breach extend beyond eMudhra itself, potentially affecting a wide range of systems that depend on secure communications. The incident underscores the critical importance of robust cryptographic practices in maintaining trust in digital communications.
As eMudhra steps away from the TLS certificate market, the cybersecurity community is left to grapple with the ramifications of this breach and the broader implications for certificate authorities and the security of online communications.
For further details on the incident, refer to Ars Technica.
