Something’s off.A report says certificate authority eMudhra revoked eight intermediate certificates after researchers found that their P-384 private keys could be recovered by trying only 256 possible values. One published example reportedly had a private-key value of 4.
The reported mismatch is that keys intended to help establish trust for website connections were allegedly weak enough to guess almost immediately. eMudhra reportedly attributed this to a certificate-generation script error: a second, weak set of keys was created and then selected because its labels resembled those of the proper keys.
The report says Mozilla, Google, and Apple added blocks or protections, while eMudhra said most affected intermediates were not used in production and it found no evidence that they issued end-user certificates. It also says there is no evidence the weak keys were abused.
UNVERIFIED
Feed metadata identifies a report, not independently verified underlying facts.
This source-attributed report has not been independently verified.
