eMudra
An Indian certificate authority (CA) that provides digital certificate services and is recognized by global trust stores.
Timeline (last 90 days)
The eight NIST P-384 elliptic curve keys generated by the Indian CA eMudra during its key signing ceremony all had private keys of 47 bytes of zeros (i.e., a near-zero tiny value, jokingly called '4').
The Chrome browser explicitly refuses to access websites using eMudra's problematic certificates, while the command-line tool curl retrieves the content normally without any warning and without blocking.
A researcher named Wayne scanned certificates with a key-checking tool, found eight anomalous EC keys in a disclosure library, and sent an email about the problem to Apple, Chrome, Microsoft, Mozilla and eMudra before six o'clock that evening.
Chrome confirmed and pushed an update on the same day the problem was found, eMudra acknowledged the problem the same day, and most browsers completed remediation within 24 hours.
A nearly public private key existed for more than a year, but there is currently no public evidence of large-scale abuse.
All Facts (5)
The Chrome browser explicitly refuses to access websites using eMudra's problematic certificates, while the command-line tool curl retrieves the content normally without any warning and without blocking.
50%UnverifiedA nearly public private key existed for more than a year, but there is currently no public evidence of large-scale abuse.
50%UnverifiedThe eight NIST P-384 elliptic curve keys generated by the Indian CA eMudra during its key signing ceremony all had private keys of 47 bytes of zeros (i.e., a near-zero tiny value, jokingly called '4').
50%UnverifiedA researcher named Wayne scanned certificates with a key-checking tool, found eight anomalous EC keys in a disclosure library, and sent an email about the problem to Apple, Chrome, Microsoft, Mozilla and eMudra before six o'clock that evening.
50%UnverifiedChrome confirmed and pushed an update on the same day the problem was found, eMudra acknowledged the problem the same day, and most browsers completed remediation within 24 hours.
50%