EMUDHRA : SAYS 8 GLOBAL TLS INTERMEDIATE CAS DISTRUSTED, INDIA DSC AND ESIGN UNAFFECTED

• 8 of eMudhra's several intermediate CAs in its Global TLS business were distrusted; issuing CAs were created under its ECC root at a Key Generation Ceremony on April 30, 2025 • A flaw in the KGC caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys; weak keys were published to browser root stores • An independent researcher found the weak keys could be reverse-engineered, possibly with AI-assisted techniques, and reported it to Apple, Google, Microsoft and Mozilla • Company confirms infrastructure was not compromised, no data was breached, and physical and logical security controls remained intact • Global TLS business is a very small part of operations at around 1% of company revenue, though reputational risks cannot be quantified • Working directly with affected customers on replacement certificates; root-cause investigation ongoing with root programs

eMudhra Ltd

Open attachment

← Back to feed