Disgraced eMudhra drops out of TLS business after using cert private key of 4

Summary

eMudhra is exiting the TLS business after issuing weak certificates. A flawed key generation ceremony produced certificates with trivial-to-crack private keys, allowing for the minting of trusted credentials. The company cited increasing compliance costs and low revenue from this business segment.

Key Takeaways

1. eMudhra is exiting the TLS certificate business following a security incident where it issued eight intermediate TLS credentials with critically weak private encryption keys.
2. The company cited increasing compliance costs, the low revenue generated by the TLS business (1 percent of total revenue), and the availability of free TLS certificates as reasons for withdrawal.
3. A flaw in a Key Generation Ceremony (KGC) caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys, with the weak keys being published to browser root stores.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article relies on technical details and official statements from the company involved. It presents a clear explanation of a security incident and the company's response. The information is presented factually with minimal speculation.

Bias assessment: Technically Focused Reporting. The article prioritizes technical accuracy and the factual reporting of a security incident. It avoids emotional language or partisan framing, focusing on the technical aspects of the eMudhra certificate debacle.

Note: This article provides a detailed technical analysis of a security incident. Readers should be aware of the technical jargon and focus on the factual reporting of the event and the company's response.

Credibility flag: Technical Deep Dive

Claimed Facts (8)

• This statement presents a factual account of eMudhra's decision and the core issue of weak certificates.
• This statement provides specific reasons attributed to the company's chairman for their business decision.
• This statement provides a timeline and factual basis for the company's announcement.
• This statement presents specific technical data regarding the compromised certificates.
• This statement describes a factual action taken by browser manufacturers in response to the incident.
• This statement factually reports on the company's communication regarding the incident.
• This statement provides a factual definition of Hardware Security Modules.
• This statement provides a factual definition of a Certificate Revocation List.

Opinions (7)

• This is an idiomatic expression conveying a dismissive sentiment, not a factual statement.
• This is a quote expressing the company's perspective on the public reaction, which is subjective.
• This is a statement of the company's conclusion and decision, reflecting their judgment.
• While reporting what the company said, the framing of 'explanation for the debacle' implies a subjective interpretation of the event's cause.
• This is part of the company's explanation, presenting their interpretation of what went wrong.
• This is part of the company's explanation, presenting their interpretation of what went wrong.
• This is a statement of intent and ongoing effort, reflecting the company's current position.

Claims (6)

• This is a partial explanation that, while presented as a cause, is still an assertion from the company about a complex technical failure.
• This is a lengthy, self-reported explanation of a complex technical failure, which, while detailed, is still an unverified account from the party responsible for the failure.
• This is part of the company's explanation of the technical failure, detailing a sequence of events that led to the issue.
• This is an admission of human error, which, while plausible, is a broad statement about the cause of a significant security lapse.
• This is a statement of ongoing investigation, implying that the full root cause is not yet definitively established.
• This is a statement of future action, indicating a proactive measure but not yet a confirmed finding.

Key Sources

• Dan Goodin — Author
• eMudhra — Certificate Authority
• V. Srinivasan — Chairman of eMudhra Limited
• Sectigo — Certificate Authority