Skip to content

Document root cause of eMudhra intermediate compromise: trivially small private keys #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MagicalTux merged 1 commit into from
Oct 20, 2026
Merged

Document root cause of eMudhra intermediate compromise: trivially small private keys #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions CHANGELOG-roots.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,8 +43,25 @@ it to `*.disabled`.

Rationale: on 2026-10-17 the private keys of eight eMudhra intermediate CA
certificates were reported to the root programs as compromised. The reporter
proved it by signing a test message with each key. These intermediates chain to
this root. Mozilla blocked them through OneCRL and is removing the root in
proved it by signing a test message with each key. The keys were not stolen:
eMudhra generated them badly. Each intermediate's P-384 private scalar is a tiny
integer, so anyone can recover it by computing `k·G` for small `k` and comparing
the result with the certificate's public key:

| Intermediate | Private key |
|---|---|
| EM OV TLS CA - G3C | 4 |
| EM EV TLS CA - G3C | 56 |
| EM OV CS CA - G3B | 66 |
| EM EV TLS CA - G3B | 115 |
| EM OV TLS CA - G3B | 155 |
| EM DV TLS CA - G3B | 156 |
| EM DV TLS CA - G3C | 230 |
| EM OV CS CA - G3C | 237 |

We checked each value against the public keys in the incident's
`impacted-intermediates.json`. The keys date back to issuance (April 2025), so
the intermediates were never secure. These intermediates chain to this root. Mozilla blocked them through OneCRL and is removing the root in
NSS 3.131.1. Chrome blocked them with a CRLSet and is removing the root in Chrome
Root Store version 43. Apple and Microsoft acted on 2026-10-19 and 2026-10-20.
`cacrt` has no revocation channel of its own, so we follow Mozilla's guidance for
Expand Down
2 changes: 1 addition & 1 deletion roots/eMudhra/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ eMudhra's certificates are logged to publicly operated Certificate Transparency

## Past non-compliance

**Intermediate key compromise (October 2026):** The private keys of eight eMudhra intermediate CA certificates, chaining to emSign ECC Root CA - G3, were compromised. A reporter proved this to the root programs on 2026-10-17 by signing a test message with each key. Firefox and Chrome blocked the intermediates the same day, Apple on 2026-10-19 and Microsoft on 2026-10-20. Mozilla (NSS 3.131.1) and Chrome (Root Store v43) are removing the root. [[Mozilla Security Blog]](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/) [[dev-security-policy thread]](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ)
**Intermediate key compromise (October 2026):** The private keys of eight eMudhra intermediate CA certificates, chaining to emSign ECC Root CA - G3, were compromised. A reporter proved this to the root programs on 2026-10-17 by signing a test message with each key. The root cause was key generation: each intermediate's P-384 private key is a tiny integer (4, 56, 66, 115, 155, 156, 230 and 237), recoverable by anyone in a fraction of a second, so the intermediates were insecure from issuance in April 2025. Firefox and Chrome blocked the intermediates the same day, Apple on 2026-10-19 and Microsoft on 2026-10-20. Mozilla (NSS 3.131.1) and Chrome (Root Store v43) are removing the root. [[Mozilla Security Blog]](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/) [[dev-security-policy thread]](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ)

Before this, three compliance incidents have been documented in Mozilla Bugzilla:

Expand Down
Loading