Indian certification authority eMudhra issued eight intermediate certificates with private keys that are easily compromised. The company released six TLS certificates and two code-signing certificates containing private keys only 1 byte long, making them vulnerable to brute-force attacks in less than a second.
These compromised keys allow attackers to impersonate any domain or forge digital signatures for applications, potentially appearing as legitimate software from companies like Microsoft or Google. The incident affects a vast range of hardware and software, including operating systems, browsers, servers, routers, and IoT devices.
While modern browsers using Certificate Transparency features may mitigate risks for standard web traffic, the incident requires widespread updates to revocation lists. Many older devices, such as legacy routers and appliances, may remain vulnerable if they do not receive necessary security patches for their certificate trust stores.
The root cause of the incident, specifically how the 1-byte keys were generated, remains under investigation. Users are advised to update all software and operating systems to ensure the affected certificates are properly revoked or rejected by their systems.
