Indian CA eMudhra issues TLS certs with 3-8 bit private keys, enabling forgery

eMudhra Limited, an Indian certificate authority, has issued eight TLS certificates with critically weak private keys (3-8 bits of entropy instead of the standard 384 bits for P-384 ECC). This allows attackers to trivially derive the private keys and forge certificates, potentially enabling impersonation of secured domains. The incident is under investigation; the full scope of affected certificates and any exploitation remains unclear.

AI disclosure: Model-written summary of the source, not a verified fact. Check the sources. How Mosaic works