Eight flawed TLS certificates trigger global internet security alert
Security experts have flagged eight compromised TLS certificates from Indian issuer eMudhra, revealing private keys with only 3 to 8 bits of entropy. This defect, far smaller than the standard 384 bits, allows attackers to decrypt secure traffic. The incident echoes the 2014 Heartbleed vulnerability, prompting urgent patching efforts. Analysts warn that recovering from such a widespread cryptographic failure will be time-intensive due to the heterogeneity of modern internet infrastructure.
Key points
- Eight TLS certificates issued by eMudhra, an Indian certificate authority, were found to have defective private keys ranging from 3 to 8 bits of entropy.
- The compromised keys are significantly smaller than the standard NIST P-384 elliptic curve size, which typically contains 384 bits of entropy.
- The vulnerability allows unaffiliated hackers to decrypt TLS-protected exchanges, potentially exposing session cookies, passwords, and private keys.
- The incident is compared to the 2014 Heartbleed vulnerability, which compromised thousands of servers and required years of remediation.
- Experts note that recovery is complex because it requires patching numerous devices, reissuing millions of keys, and rotating credentials across diverse systems.
- The defect challenges engineers' expectations, as the key sizes were so small that many initially found the findings difficult to imagine.
The global internet infrastructure is on high alert following the discovery of eight compromised TLS certificates issued by eMudhra, an Indian certificate authority. Security researchers identified that the private keys associated with these certificates contained a critically low amount of entropy, ranging from just 3 to 8 bits. This is a stark contrast to the standard NIST P-384 elliptic curve cryptography, which typically utilizes 384 bits of entropy to ensure robust security. The defect means that the number of possible key combinations is drastically reduced, making it feasible for attackers to brute-force the keys and decrypt secure communications.
The impact of this vulnerability mirrors the 2014 Heartbleed bug in the OpenSSL library, which allowed hackers to recover private keys, session cookies, and passwords from thousands of servers. At the time, Heartbleed affected major corporations and government agencies, leading to a multi-year recovery process. Similarly, the current eMudhra incident requires a comprehensive response involving the patching of affected devices, the revocation of old certificates, and the reissuance of millions of new keys. This process is resource-intensive and requires coordination across a wide range of systems, from embedded devices to large-scale server farms.
Experts warn that the current situation is more complex than previous incidents due to the increased heterogeneity of the modern internet. As one analyst noted, coordinating actions across different contexts and people takes a long time, and the current landscape involves more diverse systems than in 2014. The discovery of such small key sizes has challenged the expectations of many engineers, who are now working to assess the full scope of the exposure. The incident highlights the ongoing challenges in maintaining cryptographic security at the scale of the global internet.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
