eMudhra Limited, an Indian Certificate Authority, issued eight TLS certificates with severely defective private keys containing only 3 to 8 bits of entropy instead of the expected 384 bits for NIST P-384 elliptic curve cryptography. The private keys were: 4, 56, 66, 115, 155, 156, 230, 237 bits. These weak keys can be brute-forced, allowing attackers performing man-in-the-middle attacks to decrypt and intercept TLS communications.
| Vendor | Product | Versions |
|---|---|---|
| emudhra | tls certificates | — |
Loading…
