NEUTRAL· 45

A company that vouches for websites had secret keys so weak that 8 of them were cracked

Originally reported by CoinDeskPublished 21 Oct, 09:41 ISTAI analysis 21 Oct, 10:39 ISTRead the original article

What happened — 5 key points

1Eight private keys belonging to Indian certificate authority eMudhra were compromised due to weak generation methods.
2Researchers discovered that eMudhra used easily guessed small integers instead of strong random numbers for its private keys.
3Major browser makers quickly blocked the affected certificates to prevent mainstream website impersonation.
4Crypto tools and backend scripts that do not check for certificate revocation could potentially remain vulnerable.
5No crypto attacks or active exploits using these compromised keys have been reported so far.

Key takeaway

A certificate authority used extremely weak security keys, allowing researchers to crack them quickly. While web browsers are protected by rapid patches, automated crypto tools and backend scripts could remain at risk if they do not check for revoked certificates.

Short-term impact (days–weeks)

NEUTRAL

Most major browsers and software packages have already implemented emergency patches.

Medium-term impact (1–3 months)

NEUTRAL

Developers may need time to fully update backend scripts and APIs that ignore revocation lists.

Key risks

Potential network interception of crypto trading bots and APIs using unpatched software.
Failure of certain backend applications to check for revoked digital certificates.
Uncertainty regarding whether historical traffic was intercepted before the keys were revoked.

This page summarizes and analyzes publicly reported news. Read the full story at the original source. AI-generated analysis — not financial advice.

What happened — 5 key points

1Eight private keys belonging to Indian certificate authority eMudhra were compromised due to weak generation methods.

2Researchers discovered that eMudhra used easily guessed small integers instead of strong random numbers for its private keys.

3Major browser makers quickly blocked the affected certificates to prevent mainstream website impersonation.

4Crypto tools and backend scripts that do not check for certificate revocation could potentially remain vulnerable.

5No crypto attacks or active exploits using these compromised keys have been reported so far.