Something’s off.A report says eight intermediate TLS certificates associated with eMudhra Limited had private keys with only 3 to 8 bits of entropy. Because intermediate certificates can sign credentials trusted by browsers and apps, the report says control of those keys could enable unauthorized certificates for any Internet site.
The oddity is the reported key size: the article contrasts it with roughly 384 bits of entropy for a normal NIST P-384 private key. A digitally signed message was presented as proof that one affected key was controlled, prompting browsers and some other software to block the certificates, according to the report. It also says no malicious use had appeared in certificate-transparency logs at the time of publication, while older systems and embedded devices could take longer to update.
UNVERIFIED
Hacker News metadata is a discovery lead, not verification of the linked claim.
This source-attributed report has not been independently verified.
