Compromised TLS Certificates
Summary
Indian CA eMudhra Limited issued eight TLS certificates with critically weak private keys, ranging from 3 to 8 bits of entropy. This vulnerability significantly undermines the security of these certificates, potentially allowing attackers to impersonate legitimate websites.
IFF Assessment
Compromised TLS certificates with weak private keys allow attackers to impersonate legitimate websites, posing a direct threat to user security and trust.
Severity
The vulnerability allows for trivial key compromise due to extremely weak entropy (3-8 bits). This enables an attacker to easily forge digital certificates, leading to high impact on confidentiality, integrity, and availability, as well as network and user exposure.
Defender Context
This incident highlights the critical importance of robust key management practices within Certificate Authorities. Defenders should be vigilant about the integrity of TLS certificates they trust and be aware of potential risks associated with certificates from CAs that have experienced security lapses.