Security · Updated 21 Oct, 04:49 pm IST
eMudhra weak keys compromise risks global web security
Why it matters for readers: It explains how a small technical error in key generation can threaten the privacy and authenticity of HTTPS connections you use daily.
- eMudhra said a flaw during key generation on April 30, 2025 produced a second set of weak private keys alongside strong keys.1
- The weak keys had extremely low bit strength—some as small as the digit 'four' and others between three to eight bits—rather than the expected ~384-bit strength.1
- An independent researcher known as 'Wayne' reverse-engineered and uncovered the keys, flagged the issue to Apple, Google, Microsoft and Mozilla, and created a live test site to demonstrate the problem.1
- Browser vendors have blocked all eight affected intermediate certificates after being alerted to the compromise.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started