eMudhra intermediate certificate key compromise probed by Mozilla amid bad-faith claims
basedjensen · x · 2026-10-24
Mozilla Bugzilla has opened P1 defect 2083449 against Indian CA eMudhra over a possible private key compromise of intermediate certificates, classified as a cryptographic security issue and CA compliance matter.
The controversy: analysis shows a P-384 private scalar below 256 cannot be produced by compliant in-module key pair generation, suggesting key material was fed in or a key object was created from supplied material. eMudhra attributes the weak keys to a code flaw during an approved wrap/unwrap test deviation at the 30 April 2025 key generation ceremony. Commenter @karishnu argues the company may have deliberately added a step to the key generation process rather than making a dumb mistake. Mozilla investigators are now demanding the KGC script, the specific code flaw, and the exact call mechanism that created the second key pair.
Related event: Mozilla opens P1 investigation into eMudhra intermediate CA key leak(2 posts)→
More from Safety
- AI finds dormant critical software bugs, but defenders hold the edge — ShakeelHashim · 2026-10-24
- UK announces £600m+ AI package spanning biosecurity, AISI funding, chip design — HaydnBelfield · 2026-10-24
- Google Chrome team slams eMudhra over CA key fiasco, calls out delays — basedjensen · 2026-10-24
- Developer finds Samsung TV sluggishness culprit: on-device vision models processing screenshots and audio — basedjensen · 2026-10-24
- AI Agents Breached 100+ Company Websites at $50 per Break-in — alex_verem · 2026-10-24
- Samsung TVs found running facial recognition code that returns face bounding boxes — basedjensen · 2026-10-24