New Delhi, Oct. 21 -- A flaw that generated weak cryptographic keys at Indian digital certification company eMudhra has triggered a security investigation and protective action by major web browsers, raising concerns about the trust mechanisms that keep online transactions secure. The Ministry of Electronics and Information Technology (MeitY) said on Wednesday that it had formed a special team to investigate the incident, while assuring users that its impact on Indian websites and applications was limited and brief.
The Indian Computer Emergency Response Team (CERT-In) said eMudhra had reported a security breach involving the private keys linked to eight digital certificates used to secure websites and authenticate software. Six were used for Transport Layer Security (TLS), which helps protect data exchanged between browsers and websites, while two were related to code signing.
The concern is that compromised keys could potentially be exploited to undermine digital trust. In a worst-case scenario, cybercriminals could attempt to impersonate legitimate websites, including payment platforms, and trick users into transferring money or sharing sensitive information.
eMudhra said a flaw in its system had generated weak keys alongside the original strong keys. A security researcher alerted Apple, Google, Microsoft and Mozilla that these weaker keys could potentially be reverse-engineered, possibly using artificial intelligence-assisted techniques.
The disclosure prompted swift action. Google blocked the public keys associated with the affected TLS intermediates in Chrome through a Certificate Revocation List Set update. Mozilla also blocked all six affected TLS intermediate certificates.
MeitY sought to distinguish the affected business from eMudhra's Indian operations. The company provides digital signature certificates and eSign services regulated by the Controller of Certifying Authorities (CCA), which the ministry said remain completely unaffected.
The incident relates instead to eMudhra's global business of issuing certificates trusted by browsers and operating systems to authenticate websites and secure online communications. This international business operates under a global trust framework and undergoes independent audits, including WebTrust audits conducted by BDO International Limited.
"The impact of this incident on Indian websites and applications has been very limited and for a very short interval," the ministry said. It also criticised some social media accounts for what it called "fear-mongering" over the incident.
eMudhra maintained that its infrastructure had not been compromised, no data had been breached and its physical and logical security controls remained intact. The affected global TLS business contributes around 1 per cent of its revenue, although the company acknowledged that the reputational damage could not yet be quantified.
The company is contacting potentially affected customers to provide replacement certificates and avoid disruption to critical services. It is also coordinating with browser root programmes as investigations continue.
CERT-In has issued an advisory with mitigation measures, while MeitY said it would share further details after the probe is completed.
Published by HT Digital Content Services with permission from Millennium Post.