eMudhra disabled FIPS on HSM, Python script truncated CA private keys to one byte
matthew_d_green · x · 2026-11-11
- Certificate authority eMudhra's incident report reveals FIPS mode was disabled on its HSM, the CA private key was exported into Python on a regular computer, and got truncated to one byte during re-import.
- Security researchers Scott Helme and Matthew Green flag the bigger question: if this CA could export private keys from an HSM, how many CAs are running theirs the same way?
More from Safety
- OCC Puts Autonomous AI Payment Agents in Highest Risk Tier for US Banks — rohanpaul_ai · 2026-11-11
- Anthropic warns its AI is improving itself faster than safety measures can keep up — TinfoilTricorn · 2026-11-11
- Security researcher: Abliterated models drastically improve offensive-security reasoning — matthew_d_green · 2026-11-11
- User sounds alarm on Ring's poor privacy standard over outsourcing door camera footage for other purposes — R4nsack · 2026-11-11
- NEAR AI discloses SGLang vulnerability exploit, touts TEE as the fix — AccBalanced · 2026-11-11
- FT: Commerce Dept stalls Megaspeed export blacklist despite 4 agencies pushing over Nvidia chip smuggling — rohanpaul_ai · 2026-11-11