'Gross negligence, unforgivable': eMudhra faces fury over security lapse, techies question leadership

Bengaluru-based digital certification company eMudhra is facing fierce criticism from technology professionals and investors after a major security lapse exposed eight cryptographic private keys. 

The breach has raised concerns about the integrity of digital certificates used to establish trust in websites.

Critics have questioned the company's technical competence, leadership credentials, and government business. Some have even called for it to be barred from operating.

The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate the incident.

Google and Mozilla have already taken steps to block affected certificates after researchers discovered that private keys meant to be protected by strong cryptography could be reconstructed using extremely small numbers.

The compromised keys were reportedly 4, 56, 66, 115, 155, 156, 230 and 237, instead of the extremely large random values expected in a secure cryptographic system.

'26/11 equivalent digital disaster': Rajeev Mantri

Navam Capital Managing Director Rajeev Mantri launched one of the strongest attacks on eMudhra. He described the incident as a failure that demanded accountability from both the company and officials responsible for awarding government business.

"What has been committed by the turds of eMudhra is a 26/11 equivalent digital disaster," he wrote on X. "This entity should be finished off. Anybody who was linked to this fiasco should never get into a position of responsibility in cybersecurity." 

Mantri said the officials who allowed this entity to win so much government business should be pulled up. "Our country cannot fool around in this manner when we are pushing digitalization in practically all domains of business, government and citizen services." 

In an earlier post, Mantri had said: "A shocking degree of incompetence, stupidity and gross negligence. Inexcusable and unforgivable. It is insane and scary how this company managed to grab so much government business with this hyper incompetence. This company should cease to exist."

Investor Anurag Ramdasan also questioned whether eMudhra should be allowed to continue operating after the incident.

"I do not mean to sound dramatic but post this emudhra should simply not be allowed to continue as a business. this is the same as if delhivery picked up all your product from ecomms and threw it in trash and delivered an empty box to you every single time," he said.

'You had one job': Former Google engineer Deedy Das

Former Google engineer and Silicon Valley investor Deedy Das criticised the company's handling of cryptographic keys, pointing to the extremely small values associated with the compromised certificates.

"Gross incompetency from Indian certificate authority eMudhra. You had one job: generate a 384 bit private keys and instead you used: 4, 56, 66, 115, 155, 156, 230, and 237. This allows attackers to issue certificates for any websites."

Das also questioned the technical backgrounds of the company's leadership and employees. 

"Embarrassing that it's a family business run by largely computer-illiterate people. Only 1 of the 3 have a remotely computer-related background and even they never actually worked a technical job in their life. If you look at LinkedIn, their tech team is young, from tier 3 education, and paid sort of bottom-barrel," the tech investor said. "Imagine how many attacks you can design with AI given the existence of this genre of gross negligence."

According to the company's published profiles, founder chairman V Srinivasan has a bachelor's degree in mathematics from the University of Madras and professional memberships in accounting, cost accounting and company secretarial institutions.

Co-founder Kaushik Srinivasan has a bachelor's degree in computer engineering and a master's degree in computer engineering with a focus on networking from Stevens Institute of Technology in the United States. His previous experience includes roles at UBS Wealth Management and Trafelet Delta Funds.

Executive Vice President and Director for International Sales and Strategy Arvind Srinivasan holds a master's degree in finance from the University of Michigan and an MBA from Oxford University's Saïd Business School. His earlier career included positions at Barclays Capital.

Technology professional Shobhit Bakliwal also criticised the company's leadership, writing: "This is their leadership team. As per Google, it's a family business. The founding chairman is a CA - chartered accountant who thought that this CA (certificate authority) is probably the same? I am enraged by the incompetence shown."

Former Meta engineer questions government business

Former Meta engineer Arnav Gupta questioned how eMudhra secured government and public-sector business, alleging that its market position reflected government connections rather than technical merit. "What a terribly poor situation. And it happens because of lack of actual meritocracy in India. What is eMudhra business model? Regulatory capture. What is their competency? Being in cahoots with the govt."

What went wrong at eMudhra?

The incident involves eight intermediate certification authorities associated with eMudhra's global digital certificate business, including six used for website security and two for code signing.

Digital certificates help browsers and other applications verify the identity of websites and establish secure connections. If the private keys used to issue such certificates can be reconstructed, attackers could potentially create fraudulent certificates to impersonate legitimate websites.

According to eMudhra, the problem originated during a key-generation ceremony on April 30, 2025.

The company said a flaw in a process involving the wrapping and unwrapping of cryptographic keys produced a second set of weak keys alongside the original strong keys. The weaker keys were mistakenly published to browser trust stores.

"A flaw in the KGC (Key Generation Ceremony) caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to the browser root stores. eMudhra is working to establish the root cause," it said in a statement. 

The problem came to light after a security researcher alerted major browser companies. Google and Mozilla subsequently blocked the affected certificates to prevent their misuse.

The IT ministry said eMudhra operates in two distinct areas. The first is the issuance of Digital Signature Certificates and eSign services. The second is the issuance of digital certificates trusted by major browsers and operating systems, used to secure websites, software and online communications. 

The second function is international in nature and operates under a global trust framework, the ministry said. It is governed by international standards and subject to independent audits, including WebTrust audits conducted by BDO International Limited. 

The ministry added that the reported incident pertains only to this global function, and that MeitY is not involved in its audit. "The impact of this incident on Indian websites and applications has been very limited and for a very short interval," the ministry said.