Eight compromised digital security certificates issued by eMudhra revealed private key sizes ranging from 3 to 8 bits instead of standard cryptographic entropy.
Experts noted the flaw falls firmly into the realm of the mathematically impossible, suggesting a severely flawed key generation interface or leaked example code.
The digital keys of these certificates should normally be around 384 bits in size, thus offering a wide range of random combinations for security purposes. However, it was discovered that the actual key sizes ranged significantly lower, with specific values being 4, 56, 66, 115, 155, 156, 230 and 237.
Experts' assessments of the problem
Experts who looked into the issue said that such a situation should not be possible in theory. Security expert Filippo Valsorda estimated that there may have been an error in setting a size parameter when generating the keys. For his part, Ben Cartwright-Cox, director of BGP.tools, said that some code that was intended only as an example may have ended up in real operation, adding that it is impressive that the error went unnoticed.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)