eMudhra Digital Certificates Blocked After Cryptographic Flaw

#GS-3 #Science & Technology #Cyber Security #Current Events #National #Economy

Key takeaways

Major global web browsers blocked digital certificates issued by eMudhra following a serious cryptographic flaw.
Founded in 2008, eMudhra holds nearly 38% of India's digital signature certificate market under the IT Act, 2000.
A key generation error on April 30, 2025, produced weak private keys that compromised eight intermediate certificates using less than the required 384-bit security.

Major global web browser vendors like Google, Mozilla, Apple, and Microsoft took emergency action to block digital certificates issued by eMudhra.
The emergency measures followed the exposure of a severe cryptographic flaw in certificates issued by the Bengaluru-based certifying authority.

The certificates include digital credentials and Public Key Infrastructure (PKI) items such as Transport Layer Security/Secure Sockets Layer (TLS/SSL) and code-signing certificates.
These credentials are used globally to authenticate website identities, encrypt web traffic, and verify legitimate software publishers.
Founded in 2008, eMudhra is a CCA-licensed digital identity and security firm under the IT Act, 2000.
The firm holds nearly 38% of India's digital signature certificate market.
The aim of the system is to establish a secure and cryptographically validated web ecosystem by providing trusted digital identities and encrypting sensitive online communications using HTTPS/TLS.
Other key goals include preventing eavesdropping and ensuring that software remains tamper-resistant.

The system operates through a hierarchical Public Key Infrastructure where a universally trusted Root CA signs Intermediate CAs.
These Intermediate CAs issue digital certificates directly to end-user websites or software developers.
The technology uses mathematically paired public and private keys for asymmetric cryptography.
The public key is distributed through browsers to verify identities and start encrypted sessions, while the private key must stay strictly secret to create digital signatures.
When a user visits an HTTPS website, the browser traces the certificate chain up to a pre-installed trusted root in its trust store.
An encrypted connection is established if the mathematical signature matches the expected values.

An internal error during a cryptographic key-generation exercise on April 30, 2025, produced weak private keys.
This mistake compromised the security of several intermediate certificates.
Eight intermediate certificates, consisting of six website authentication and two code-signing items, used predictable private keys instead of the required 384-bit cryptographic security.
These easily recoverable private keys created risks for potential forged TLS certificates, man-in-the-middle attacks, website impersonation, and malicious software signing.
Mozilla and Google blocked the vulnerable intermediate certificates through OneCRL and CRLSets.
They also took steps to distrust the parent emSign Root TLS CA - G3.