A serious cryptographic error at the Indian certificate authority eMudhra exposed eight private keys from intermediate certificate authorities. One key had a numerical value of just 4, making it easy to guess.
The major browser vendors have since implemented emergency measures. However, security experts expect it could take years to patch all vulnerable systems.
A security researcher known as Wayne discovered the leak. He found that eight intermediate CA certificates issued by eMudhra were based on private keys that had been generated with insufficient randomness.
According to Ars Technica , the private keys had the values 4, 56, 66, 115, 155, 156, 230, and 237. The keys could be represented using only 3 to 8 bits, which is significantly less than the approximately 384 bits expected from correctly generated P-384 cryptographic keys.
The cause of the error is not yet known. The director of BGP.tools, Ben Cartwright-Cox, suggested that sample code may have been accidentally used in the production environment.
To demonstrate the problem, Wayne used one of the compromised keys to sign a message with the text “We have a problem here, Wayne.” His observations were published on emudhra.we-have-a-problem.com.
Biggest challenge outside standard browsers
Google and Mozilla blocked the affected certificates on October 17. Apple and Microsoft followed suit later. However, Ars Technica reports that, as of the time of publication, Edge on Windows 10 was still connecting to twelve vulnerable hosts.
The biggest challenge lies outside of mainstream browsers. Linux distributions, Docker containers, embedded systems, and IoT devices may require separate updates. Some applications also manage their own certificate stores, which complicates a coordinated solution.
Intermediate certificate authorities can issue certificates that browsers and operating systems recognize as legitimate. Attackers with private keys could generate fraudulent certificates for websites they don’t control.
Combined with the ability to intercept network traffic, this could enable man-in-the-middle attacks on connections normally secured by TLS. VPN users may be at significant risk. This is particularly true in countries where governments intercept internet traffic.
No confirmed malicious use
So far, no confirmed evidence shows attackers have exploited the compromised keys. The Certificate Transparency logs do not yet show any malicious certificates issued using those keys. However, this does not guarantee that no abuse has occurred. eMudhra clarified that the affected intermediate certificate authorities had not issued any certificates to end users.