Repository navigation
Archive compromised eMudhra intermediates and their private keys as evidence - #10
Merged
Merged
Conversation
…vidence Add evidence/2026-10-emudhra-intermediates/ with all 16 CA-signed intermediate certificates (8 eMudhra-issued, 8 Sectigo AAA cross-signs), the 8 P-384 private keys (d = 4, 56, 66, 115, 155, 156, 230, 237), the issuing roots, the incident's source JSON, and a verify.sh that checks key/cert matches and issuer signatures with OpenSSL alone. The directory is outside roots/ so build.rs never sees it, and it is excluded from the published crate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #6 and #8. Adds
evidence/2026-10-emudhra-intermediates/, an archive anyone can verify for the eMudhra intermediate key compromise:certs/: all 16 CA-signed intermediate certificates (8 issued by emSign Root TLS/CS CA - G3, 8 cross-signed by Sectigo AAA Certificate Services)keys/: the 8 P-384 private keys, d = 4, 56, 66, 115, 155, 156, 230, 237issuers/: the issuing roots, plus emSign ECC Root CA - G3source/:impacted-intermediates.jsonandroots.jsonfrom https://emudhra.we-have-a-problem.com/; every certificate's SHA-256 matches its published fingerprintverify.sh: OpenSSL-only checks that each key matches its certificate's public key, that the key can sign and verify, and that each certificate's signature is valid against its issuer (all 16 pass)The keys are revoked (
cACompromise) and blocked by all four major root programs. Their values were already public in #8 and on the incident site.Safety:
build.rsonly readsroots/, so the archive never reaches the compiled store/evidenceis excluded from the published crate (cargo package --listconfirms it)CHANGELOG-roots.mdandroots/eMudhra/README.mdnow link to the archive.cargo buildandcargo testpass.🤖 Generated with Claude Code