Comment by Gigachad
6 hours ago
An Indian Certificate Authority eMudhra was found to have a private key that’s literally the number 4. So using that you can sign valid https certs for anything that isn’t checking the revoked list.
6 hours ago
An Indian Certificate Authority eMudhra was found to have a private key that’s literally the number 4. So using that you can sign valid https certs for anything that isn’t checking the revoked list.
They had 8 intermediate certs with private keys under 1 byte (<256). The most egregious was 4, but any of those 8 were pitiful.
It would’ve almost been better if the eight keys were just 1 2 3 4 5 6 7 8
That's the combination to my HSM!
Why is it important to you to mention they're indian in this context?
Well it helped me understand the source of the strange flag.
For starters, they are not American, and this site has a predominantly American and European audience and participation.
Also, while I'm not sure what a "mudhra" is, I do know that mudra is a Hindu term for a sign or symbol made by the hands, for example the way an idol is posed in a temple. It's a form of sacred sign language. Therefore, "mudra" or its related term is intrinsically linked to Hinduism in India.
Also, I am the kind of pessimist who goes through my device's root stores, and I "distrust" every root CA that I don't need to trust. This has never broken anything within my perception. I distrust the Turkey CAs, the Chinese communist CAs, the Indian CAs, and any other non-NATO sorts who have no reason to be serving any data to my devices.
* the compromised eMudhra certs were not root CAs but intermediates.