eMudhra enlists KPMG for independent probe into security key vulnerability

Digital certification firm eMudhra has appointed KPMG as its independent external reviewer for the web security key vulnerability matter, the company said on Friday.

eMudhra issues digital signatures and website security certificates to enable them to securely connect to browsers for public access.

"The appointment fulfils the commitment the company made in its press release of October 21, when it said an independent entity would examine the matter. KPMG is among the leading global networks of professional services firms," the company said in a statement.

The vulnerability was discovered by cybersecurity researchers who shared the findings with Apple, Google, Microsoft and Mozilla that the weak keys could be reverse-engineered possibly with AI-assisted techniques.

eMudhra said that its infrastructure was not compromised, no data was breached, and all physical and logical security controls of the firm remained intact.

The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate the incident at eMudhra.

CERT-In said that the issuance of digital signature certificates and eSign services, regulated by the Controller of Certifying Authorities under MeitY, are not impacted.

"We said on October 21 that someone from outside the company would look at what happened, and we have now appointed KPMG to do that. Our customers and shareholders should be able to rely on the findings, and we will act on whatever the review tells us," Kaushik Srinivasan, Co-founder of eMudhra, said.

What happened in the eMudhra security incident

The issue involved eight intermediate Certification Authority (CA) certificates in eMudhra's global TLS business. These certificates sit within the chain of trust that allows browsers and operating systems to verify that a website's security certificate is legitimate.

CERT-In said the affected private keys were generated with insufficient cryptographic randomness. The P-384 elliptic-curve keys had values that were so small they could be recovered almost instantly from their corresponding public keys. The problem was with the key-generation process and not with the P-384 cryptographic algorithm itself.

This created a potentially serious security risk. Someone who recovered an affected private key could potentially create fraudulent TLS certificates for websites they did not control, allowing them to impersonate legitimate websites or facilitate man-in-the-middle attacks. Two of the affected certificates were also related to code signing.

The issue came to light on October 17, when an independent researcher reported the compromised keys to major browser and technology companies. Google subsequently blocked the affected TLS intermediate keys in Chrome, while Mozilla also blocked the certificates. Microsoft took separate steps to block the affected certificates and later removed seven associated certificates from its Windows and Edge trust lists.

eMudhra revoked all eight affected intermediate certificates on October 18. The company has maintained that none of the affected intermediates had issued end-entity certificates and that its Indian digital signature certificate and eSign businesses were not affected.