Something’s off.A report says that eMudhra, an Indian certificate authority, had private keys associated with eight intermediate certificates compromised. Security researcher Scott Helme reportedly found that one of the keys was simply the number “4”; others were reported as similarly small numbers.
The strange part is the gap between a private key’s intended secrecy and a value that the report says could be recovered from public certificates in less than a second. The report says such weak keys could let attackers create fraudulent HTTPS certificates for domains they do not control. It also says browser makers, Apple, and eMudhra took steps to stop relying on or revoke the affected certificates, while some other services may need to check their own environments.
UNVERIFIED
Feed metadata identifies a report, not independently verified underlying facts.
This is a source-attributed report that has not been independently verified.
