Siddharth 'Sid' Mathur

SFLC.in’s Statement on eMudhra Private Key Vulnerability SFLC.in is concerned about the wider cybersecurity consequences of the recently discovered security vulnerability relating to eight intermediate certificates issued by the Indian digital certification company, eMudhra. This development prompted @Google, @mozilla and @Cloudflare to block the compromisable certificates. As per Google and Mozilla’s reports, it was found that the private keys linked to the eight affected eMudhra certificates were generated with insufficient randomness. The keys contained severely truncated or trivial key values, with key strength measuring as small as four to eight bits rather than standard cryptographic requirements like RSA-2048 or ECC P-256. This could provide bad actors with ammunition to recover private keys, use them to create fraudulent certificates, impersonate legitimate websites and potentially intercept or modify communications. The incident raises serious questions about the technical safeguards employed to protect India's public key infrastructure. Digital certificates are a foundational component of internet security, as they enable users to verify the identity of websites and establish encrypted connections with online services. This includes services that utilise sensitive personal data like banking platforms, government portals, and other essential digital infrastructure. In fact, the website of the Food Safety and Standards Authority of India, is currently inaccessible due to the certificate being revoked. The site, available at URL fssai.gov.in/ says the website Peer’s Certificate has been revoked and that “Someone pretending to be the site could try to steal things like credit card info, passwords, or emails.” The website of Higher Education Department, Government of Kerala, remains inaccessible as well. At this moment, a message is being shown stating that the website might be impersonating highereducation.kerala.gov.i…, to steal “your personal and financial information”. Both of these websites were given certificates by eMudhra. When it comes to cybersecurity infrastructure, every response must be systematic, organised, transparent, and rigorous. The security of India's digital ecosystem cannot depend solely on independent researchers discovering critical failures. The Ministry of Electronics and Information Technology (MeitY) must undertake a close examination of the role played by the Controller of Certifying Authorities (CCA) in the country’s public key infrastructure. The CCA, appointed under Section 17 of the Information Technology Act, 2000, is responsible for regulating licensed Certifying Authorities within the statutory framework. In light of the incident, SFLC.in calls upon the CCA, the Ministry of Electronics and Information Technology (MeitY), CERT-In, and other relevant authorities to take the following steps. 1. Initiate an independent investigation into the reported compromise, as well as the key generation of other licenses CAs. The investigation should examine compliance with Sections 18, 30 and 31 of the Information Technology Act, 2000, and the applicable provisions of the Information Technology (Certifying Authorities) Rules, 2000. Failure to meet the prescribed criteria should result in revocation of the Certifying Authority’s license. 2. Strengthen technical audits of Certifying Authorities. Under the CCA's audit criteria, external audits are conducted annually and internal audits every six months. The audits, under CCA’s PKI framework, explicitly looks at whether the CA "maintains controls to provide reasonable assurance that CA key pairs are generated in accordance with industry standards." If the reported weaknesses persisted undetected for an extended period despite the audits, the CCA should review the effectiveness of existing audits under the applicable Certifying Authorities Rules and its Audit Criteria for Certifying Authorities. It must be established whether these audit mechanisms adequately tested cryptographic key generation, key management, certificate issuance, and revocation. The audits should include independent and automated verification of cryptographic key strength, randomness, and key-generation procedures. 3. Improve certificate transparency and independent monitoring. The CCA already maintains a framework of technical requirements, including its Guidelines for Issuance of SSL Certificates, X.509 Certificate Policy for India PKI, and Audit Criteria for Certifying Authorities. These frameworks address certificate management, key management, and technical security controls. 4. Issue actionable mitigation guidance to affected institutions. The CCA and CERT-In should coordinate with affected Certifying Authorities, browsers, and infrastructure providers to communicate actionable guidance to government departments, financial institutions, service providers, and other organisations that may rely on affected certificates. CCA should assess whether their implementation and independent verification are sufficient to detect cryptographic weaknesses of the kind reported in the eMudhra incident. @ccaindiapki @GoI_MeitY @IndianCERT @eMudhra @chandrarsrikant @AihikS @aseemmanchanda @ni5arga @seemay @tanishka_s2 @svaradarajan @tajmahalfoxtrot @IFEX @APC_News @theGNI @Dennis__Jackson