eMudhra certificate key flaw exposes Indian government web security
Eight intermediate private keys used by eMudhra, a major Indian certificate authority, were leaked due to a critical cryptographic flaw. The keys, used by government agencies and public sector units, were significantly shorter than standard, with one being merely the number 4. This vulnerability allows attackers to forge trusted certificates, prompting global browser developers to patch trust stores while India's MeitY investigates the impact on national digital infrastructure.
Key points
- eMudhra, a Bengaluru-based certificate authority, leaked eight intermediate private keys used to sign security certificates for Indian government websites and public sector units.
- The flaw involved using numerical keys between 1 and 256 bits instead of the standard 384-bit length, with one key consisting solely of the number 4 preceded by zeros.
- Global browser and operating system developers are updating their trust stores to stop accepting certificates signed by these compromised intermediate keys.
- The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate the incident and assess the scope of the exposure.
- The breach highlights a vulnerability in public key cryptography where insufficient key length allows attackers to infer private keys and forge trusted web identities.
- The incident follows recent data breaches at other Indian financial institutions, raising concerns about the robustness of the country's digital security infrastructure.
A significant security vulnerability has emerged in India's digital infrastructure after eight intermediate private keys from eMudhra, a Bengaluru-headquartered certificate authority, were found to be leaked. These keys are used to sign security certificates for numerous government websites and public sector units, making them critical to the trust chain for modern web browsing. The discovery, attributed to an anonymous researcher, revealed that the keys were not only exposed but also cryptographically weak.
The core issue lies in the length of the private keys. Instead of utilizing the standard 384-bit length required for robust public key cryptography, the intermediate certificates used numerical keys ranging from 1 to 256 bits. In one striking instance, a key was effectively just the number 4, preceded by 383 zeroes. This drastic reduction in complexity makes it orders of magnitude easier for an attacker to infer the private key and forge trusted certificates, potentially allowing them to impersonate government services.
In response, major internet infrastructure firms, including developers of leading browsers and operating systems, are scrambling to patch their systems. They are updating their trust stores to stop trusting certificates signed by the affected eMudhra intermediates. Meanwhile, the Ministry of Electronics and Information Technology (MeitY) has acknowledged the incident, stating that a special team has been constituted to investigate the matter. The breach adds to a series of recent data exposures in India, prompting broader scrutiny of the cryptographic standards used in national digital services.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
