Weak cryptographic keys at Bengaluru-based eMudhra could be reverse-engineered, potentially allowing hackers to impersonate websites or distribute malicious software. This security lapse raises serious questions about who oversees the firm’s international certificate business. Since these operations fall outside Indian regulatory audits, many now worry about the safety of digital trust.
Weak cryptographic keys associated with eight intermediate certificate authorities operated by eMudhra could be reverse-engineered, or recovered, potentially allowing the issue of fraudulent certificates to impersonate websites or make malicious software appear trustworthy.
A security lapse at Bengaluru-based cybersecurity company eMudhra has raised a critical question about who oversees the security of certificates that help establish whether websites and software can be trusted. The incident has also drawn attention to the oversight of eMudhra's international certificate business, which falls outside the audit purview of India's digital signature regulator. Tanya Pandey explains what went wrong, who oversees the