eMudhra CA blunder: weak keys sat in browser trust stores for 18 months until researcher cracked them with AI tooling
tokenbender · x · 2026-10-22
Indian CA eMudhra published a post-mortem: 8 intermediates created in an April 30, 2025 key generation ceremony entered browser trust stores and passed two independent audits before a researcher — reportedly using AI-assisted tooling — reverse-engineered the weak keys on Oct 17, 2026; all eight were revoked the next day.
- Keys were generated on FIPS 140-2 Level 3 HSMs; the flaw was a key wrap/unwrap step in the ceremony that produced a second, weak keyset — which was the one published to root stores.
- The issue went undetected for 18 months. Impact is limited to TLS certs chaining to the distrusted ECC root within a single US customer ecosystem; the intermediates never issued a certificate, and no pre-disclosure exploitation is known.
The poster calls it an error "no 8B param model would make" and demands perma-bans and investigations for everyone involved.
More from Safety
- Dario's predictions on track: Mythos 'security tsunami' warning and 6-12 month China catch-up window — rickasaurus · 2026-10-23
- Boundless offers abliterated DeepSeek V4.1 Flash for defensive security testing — MoonL88537 · 2026-10-23
- php2shell zero-day sparks AI cybersecurity debate as Anthropic uses Claude to harden 25 OSS codebases — connoraxiotes · 2026-10-23
- PHP hit by two unauthenticated RCE flaws; ProjectDiscovery launches free internet-wide alert service — cyb3rops · 2026-10-23
- Arista VeloCloud Orchestrator SQL injection flaw, CVSS 9.9, actively exploited — AIFlow_ML · 2026-10-23
- Bindu Reddy mocks AI security panic: world didn't end, but Anthropic says it'll get 'a lot worse' — bindureddy · 2026-10-23