Eight private keys belonging to eMudhra, an Indian company that vouches for websites, have been compromised after researchers found they were based on easily guessed integers.
The discovery could allow attackers to create fraudulent digital certificates and use them to impersonate websites trusted by browsers and other software.
Major browser makers moved quickly to block the affected certificates. No attacks linked to the compromised keys have been reported, but some non-browser software could remain exposed because it does not check whether certificates have been revoked.
Researchers said all eight private keys could be recovered from publicly available certificates in less than a second. The weakness arose because eMudhra used numbers that were simple to guess when generating the keys.
Private keys are intended to remain secret. They are used by certificate authorities such as eMudhra to support certificates that verify the identity of websites. If an unauthorised person obtains one, they may be able to produce a certificate that appears legitimate.
The compromised keys were associated with eMudhra, which provides the certificates used by browsers and software to establish trust in websites. Once the problem was identified, browser makers blocked the affected certificates to prevent them being accepted.
However, the response is less straightforward for software that does not routinely check certificate revocation. Such programs may continue to trust certificates that have been withdrawn, leaving them potentially vulnerable even after browser protections have been updated.
Software makers are therefore issuing fixes and taking steps to prevent the certificates from being accepted. The incident has highlighted the consequences of using weak private-key values in systems designed to establish online trust.
Although there have been no reported attacks, the ability to reconstruct the keys from public certificates means the affected certificates could no longer be considered secure.
