According to Schneier on Security, the Indian certificate authority eMudhra Limited holds eight TLS certificates that were issued with laughably weak private keys. The weakness of these keys was such that it challenged the imagination of engineers reviewing the incident. A typical NIST P-384 elliptic curve cryptography private key includes approximately 384 bits of entropy under normal circumstances.
The discovery prompted heightened security scrutiny across affected systems relying on these certificates. While no specific domains or services are named in the source, the presence of eight certificates under eMudhra’s control that used these keys is documented. The nature of the defect—described as extremely weak—implies a failure in key generation or validation processes that fell short of established cryptographic standards.
The incident reflects concerns about certificate issuance practices when private keys lack sufficient entropy or follow expected size and complexity for the chosen cryptographic algorithm. Follow-up analysis by security researchers focused on understanding how such keys were generated, stored, and deployed. No official response from eMudhra Limited is mentioned in the source.
