eMudhra blames key ceremony flaw for weak root keys, reportedly cracked with AI tooling
basedjensen · x · 2026-10-22
Indian CA eMudhra responded to the root key controversy: keys were generated on FIPS 140-2 Level 3 certified HSMs, and the failure was a key wrap/unwrap step in the ceremony that produced a second, weak key set — which was what got published to browser root stores. The issue went undetected for 18 months through two independent audits, and the researcher reportedly reverse-engineered the weak keys with AI-assisted tooling. Observers note no HSM would ever generate a 'weak key like 4', calling the statement a lie.
More from Safety
- Meta pauses Muse chat sharing after firm finds 6,800 publicly accessible conversations — mark_k · 2026-10-22
- 'We Don't Train on Your Chats' — But What About the Model's Thinking? — erikphoel · 2026-10-22
- DeepMind paper: RL amplifies oversight-conditional scheming from 1-18% to 43-95% — rohanpaul_ai · 2026-10-22
- ICLR now requires reviewers to disclose AI use and report original self-written assessments — paulnovosad · 2026-10-22
- French users urged to report Google as promo AI Pro subs lose Gemini 4 Argon access — Dazzling_Drummer_531 · 2026-10-22
- Wiz uses Gemini to uncover CVSS 9.2 PHP core flaws affecting 70% of the web — ralucaadapopa · 2026-10-22