Source : INDIA TODAY NEWS
eMudhra, an Indian company that issues digital certificates to websites, is in the middle of a major cyber security fiasco. The company was supposed to sign its certificates using cryptographic standards that generated 116-digit key. Instead, the company used generic numbers, in one case a key containing only digit 4 along with a host of zeros. This recently led to keys of its eight certificates getting exposed. So severe was this incident that when it was reported a few days ago, within hours companies like Mozilla and Google, which make Firefox and Chrome browsers, blocked eight eMudhra certificates.
advertisement
As the company gets flak and even faces jokes and reputational damage worldwide, eMudhra cofounder has now claimed the issue impacted just a handful of certificates and that it was not a mistake from any human but result of a script error.
The cofounder, Kaushik Srinivasan, has called the recent cybersecurity incident involving unusually inept encryption keys issued by the Bengaluru-based global digital certificate provider a “one-off” incident. In an exclusive interview with India Today Tech, Srinivasan admitted the slip on eMudhra’s part though he was quick to note there was no damage done to the wider internet ecosystem as a result.
Speaking to India Today Tech, Srinivasan said the issue stemmed from a key generation process carried out on April 30, 2025.
“As a certifying authority, we routinely do these things called key generation ceremonies,” he revealed. “This issue pertains to issuing CAs that were created on April 30, 2025, a limited set of eight issuing CAs, where there was a problem basically in the script that was used to generate the issuing CA keys.” CA here refers to Certificate Authority.
“The script error led to keys that were weak in strength. It’s a script error that triggered this thing,” he added.
Notably, earlier this week, researchers found the private keys linked to eight certificates issued by eMudhra were so weak they could be recovered within seconds. This could potentially have allowed attackers to reconstruct the keys and forge digital certificates that browsers from Google, Apple, Mozilla and other companies would trust.
According to Mozilla’s incident report, all eight certificates were generated in April 2025 using P-384 cryptographic standard, but their private keys had values smaller than 256. Srinivasan, however, clarified that the keys were still 384-bit ECC keys, but a script error made them predictable and easy to recover. “These are still 384-bit ECC keys, but once you reverse them or reverse engineer them, you’re getting these kinds of small keys which are predictable,” he said.
The weak keys reportedly went undetected for around 18 months before security researchers flagged the issue.
Srinivasan acknowledged eMudhra’s internal checks failed to catch the problem, despite the certificates going through external audits earlier. “Our control and failure lapses happened. It was a script error. We should have checked. It did not happen,” says Srinivasan.
He says eMudhra is now conducting a full internal audit of its previous key generation ceremonies to determine whether similar weaknesses exist elsewhere. The cofounder claims the company may also bring in an independent third-party auditor to validate its findings.
“We can give the assurance back to the community that this was really a one-off incident by proving it with legitimate analysis, third-party analysis,” says Srinivasan.
So, should users be worried?
It is not clear if the weak keys were exploited in the wild. If someone guesses a key of a web certificate, they can use that to create a fake certificate and then can create a website — for example yahoo.co.in — and use the certificate to pretend the website is genuine. This is because when browsers connect to a website and show you a lock saying the connection is secure, they do so by checking the validity and authenticity of a certificate the website is using. If it has a genuine — but stolen or spoofed key — browsers like Firefox and Chrome will treat a website as genuine.
Srinivasan downplays the damage, if any. He clarifies eMudhra has found no evidence of similar weaknesses in its other keys, although the company is reviewing its previous key generation processes to be certain.
“We have already done assessment of all of the remaining keys as far as the global trust business is concerned. So those are not at risk,” he said. “(Our) assessment is straightforward. It was a process lapse. It’s a script error done by our team There was no infrastructure attack. There was no data breach, there was no data leak. There was nothing of that sort.”
Meanwhile, the Indian government, which often uses eMudhra certificates for its own websites and digital services, too has pushed back against what it described as fear-mongering around the incident on social media platforms. In a series of posts on X, the Ministry of Electronics and Information Technology (MeitY) said it had taken serious note of the reported vulnerability and constituted a special team to investigate the matter. “The impact of this incident on Indian websites and applications has been very limited and for a very short interval,” MeitY said.
– Ends
SOURCE :- TIMES OF INDIA
