Bengaluru, Nov 11:
India's only browser-trusted root CA, NSE:EMUDHRA, explains worst PKI failure since DigiNotar.
What happened:
- Apr 30 2025: Key generation ceremony inside FIPS-validated HSM, witnessed, air-gapped. 16 subordinate CAs — 8 ECDSA P-384 + 8 RSA-4096 — to be created.
- Team added unapproved step: custom Python script to test key wrap/unwrap for future migration between Thales Luna HSMs. Script disabled FIPS mode, unwrapped fresh private keys into ceremony laptop's RAM, re-imported.
- Bug: One line cut 48-byte scalar to first byte. So instead of random 192-bit secure number, private keys became 4, 56, 66, 115, 155, 156, 230, 237 — guessable in <1 second by brute-forcing G, 2G, 3G…
- Same script copied 8 RSA keys as plaintext outside HSM boundary — violates CA/B Forum Baseline §6.2.6 (private key must never exist outside HSM). Even though RSA keys not truncated, handling broke compliance.
Keys went live, cross-signed by Sectigo AAA root May 2025. They issued no end-entity certs — 12 intermediates dormant — but certificates contained weak public keys, so private recoverable from public.
Oct 17 2026: Researcher "Wayne" reported to Mozilla Bugzilla, Google, Apple, Microsoft. Google reproduced in 2 hours, Chrome blocked. Mozilla removed emSign ECC Root CA - G3. Apple, Microsoft pushed revocation via security updates. ∼30,000 downstream certs chaining to affected root forced replacement.
Oct 18: eMudhra revoked all 16 within 15 hrs.
Fallout:
- Stock: -20% Oct 22, -10% to Rs 318 Oct 26 — 52-week low, 43% in 5 days, Rs 1,450 cr market cap wiped.
- MeitY constituted special team, CERT-In advisory.
- eMudhra board Oct 22 decided to exit global public TLS business entirely — says it is only 1% revenue (though 60% overseas revenue includes other trust services). Transition customers to another CA by Nov 16 2026 deadline.
- Mitmproxy added option to sign certs with leaked keys — proves exploitability.
Why undetected 18 months?
No strength test at issuance, audits check process not key entropy, CRL signatures in May 2025 invalid but not flagged.
Company: “Keys generated without transfer going forward, apologise, expert review.”
Lesson: HSM is vault, but Python script left vault door open.
*Tags:* #eMudhra #ZeroDay #PKI #PythonBug #CyberSecurity #CertificateAuthority #Chrome #Mozilla