Eight intermediate TLS certificates issued by the India-based authority eMudhra Limited have been compromised. The breach was confirmed after a message signed with one of the private keys appeared online. Browser developers and major application providers have already blocked these specific certificates to mitigate potential risks.
The security failure stems from unusually small private keys, which ranged from 3 to 8 bits in size, far below the standard 384-bit entropy required for NIST P-384 keys. Experts suggest this may have resulted from a configuration error or the accidental use of example code in a production environment.
While there is no evidence that the keys have been used for malicious purposes, the cleanup process is expected to be extensive. Cryptography engineers warn that updating embedded systems, IoT devices, and various Linux distributions will be a long and resource-intensive task, potentially exceeding the scale of the Heartbleed incident.
Exploiting these compromised certificates requires an adversary-in-the-middle attack, where an attacker intercepts and decrypts traffic. While such capabilities are often limited to sophisticated actors, individuals controlling local networks, such as those in public spaces, could also pose a threat to users.
