eMudhra’s weak cryptographic keys: What went wrong and why audits failed – CNBC TV18

eMudhra's apology over the compromise of private keys associated with eight intermediate certificate authorities has raised questions about its security checks and the effectiveness of its audits. The company said it revoked the affected certificates within 14 hours of confirming the issue, but the failure to detect the weak keys during two rounds of audits remains a key concern.

In an interview with CNBC-TV18, cyber security expert Ritesh Bhatia welcomed the company's response but said a detailed investigation was needed to establish how the flaw occurred. He also called for scrutiny of its other operations, arguing that the incident had implications for trust in digital certificates beyond the company itself.

What went wrong with eMudhra's cryptographic keys?

eMudhra acknowledged a flaw in its key-generation process that resulted in weak cryptographic keys associated with eight intermediate certificate authorities.

Bhatia said the numbers generated for the keys were far smaller than expected. He cited examples such as 4, 111 and 157, saying the values were single-digit, two-digit or three-digit numbers instead of the approximately 115-digit values he expected.

What concerned him most was that the weakness had not been identified during two rounds of audits.

"In fact, I am pretty disappointed about…

Original source: https://www.cnbctv18.com/technology/