eMudhra has issued a statement regarding an incident where easily guessable private keys, with only 1 byte of entropy instead of 48, were associated with eight root certificates of the certification authority. eMudhra claims that the certificates were generated in April 2025 during a public ceremony using HSMs (Hardware Security Modules) that are compliant with FIPS 140-2 Level 3.
During the key generation process, a failure occurred, causing a second set of weak keys with zeroed out high bytes to be created alongside the main set of cryptographically secure keys at the packing/unpacking stage in the HSM (wrap/unwrap, encrypting and decrypting with the wrapping key), which was then used in the certificates. The failure went undetected, as private keys are created and stored only within the HSM and never leave it in unencrypted form. The cause of the failure remains unclear, and the company is conducting an associated investigation. It has been claimed that the problematic root certificates generated with the weak keys passed an independent audit and remained on the trusted list in all root certificate stores for two years.
Source: opennet.ru
