Weak eMudhra certificate keys prompt security blocks and lengthy clean-up
Eight intermediate TLS certificates issued by India-based certificate authority eMudhra had private keys so weak that attackers could use them to create browser-trusted credentials for any website. Browser makers and some major apps and programming languages have blocked all eight, and no certificate transparency logs show confirmed malicious use, but the incident leaves a lengthy clean-up ahead.
The keys contained only 4 to 237 bits of strength, compared with roughly 384 bits expected for the NIST P-384 curve. Experts warn that Linux systems, embedded devices, Internet of Things products and software with bundled certificate stores may take a long time to update. VPN users may face particular concern, especially where governments might intercept internet traffic; the scale of the response has been compared with the years-long clean-up after the 2014 Heartbleed vulnerability.
- Eight eMudhra TLS certificates had dangerously weak private keys.
- Major browsers and some apps have blocked them.
- Updating the wider internet could take a long time.
Read the full article at the source →
Originally published by Ars Technica as “The Internet goes on high alert after discovery of 8 compromised TLS certs”.