India's eMudhra exits TLS certificate business after weak-key scandal

India-based certificate authority eMudhra Limited, which issues the digital certificates that enable encrypted connections to websites (TLS), has announced it is leaving that line of business. The decision came two days after researchers revealed that eight intermediate certificates the company issued were protected by private keys so weak that anyone could create certificates for any website or mail server. One of the keys was simply the number 4.

The company's explanation

V. Srinivasan, chairman of eMudhra, pointed to the rising costs and complexity of compliance requirements. TLS accounts for only about 1 percent of the company's revenue. He also said that the rise of providers offering TLS certificates free of charge cut returns further compared with the firm's other products and services.

In a Thursday post, the company added that the social media amplification of the incident had brought scrutiny out of proportion to TLS's role in its business. After detailed deliberations, the board concluded that withdrawing from global SSL/TLS was the right decision for eMudhra and its shareholders.

Why it was dangerous

Researchers said the weak keys could be discovered within milliseconds. They could be used to generate TLS certificates trusted by all major browsers, as well as by countless email servers, IoT devices, Docker containers, forgotten Linux machines and unmaintained command-line tools that ship their own copy of the root certificates.

NIST P-384 elliptic curve private keys are supposed to contain roughly 384 bits of entropy, meaning 2^384 possible keys, a number with 116 digits. The eight compromised keys ranged from 3 to 8 bits in size, and the strongest had only 256 possible values. The keys were 4, 56, 66, 115, 155, 156, 230 and 237.