What caused the eMudhra security key crisis? Company releases detailed incident report

Last month, eMudhra’s security key incident raised major cybersecurity concerns, involving eight weak cryptographic keys that triggered concerns across the internet. The eight keys issued as digital certificates for websites were reportedly so weak that attackers could potentially exploit them to obtain fraudulent digital certificates. Now, eMudhra has shared a detailed report explaining what caused the incident.

The report revealed that the problem originated from a Python scripting error, suggesting that an error in the company's software script resulted in the generation of weak security keys. Once the issue was discovered, major technology companies, including Google, Mozilla, Apple, and Microsoft, released security updates to prevent potential exploitation of the compromised certificates.

Must read: What are eMudhra certificates? What to know about the security scare and could your data be at risk?

What went wrong with the security keys?

As previously reported, eMudhra Certificate Authority (CA) is responsible for issuing digital certificates to browsers, verifying whether websites are genuine and secure. During the ongoing controversy, the company was supposed to generate cryptographic keys that were 115 digits long. However, some of the keys turned out to be extremely short, and in some alarming cases, the key consisted of only the number 4.

A key as simple as 4 could be guessed almost instantly, allowing attackers to misuse the digital certificates. The keys were generated on April 30, 2025, during a key-generation ceremony using a Hardware Security Module (HSM), a specialised, tamper-resistant hardware device designed to securely generate, store and manage cryptographic keys.

Must read: eMudhra, PHP security scare: Govt to hold high-level review, audit to assess potential damage

It was further revealed that, during the key-generation process, eMudhra used a custom Python script to generate cryptographic keys for transfer between two HSMs. However, the Python script contained a bug, reducing the size of eight keys. The eight affected keys were: 4, 56, 66, 115, 155, 156, 230, 237.

However, the issue does not end here; the Python script created copies of these keys in the memory of an ordinary computer, making the keys potentially exposed outside the secure hardware environment. Hence, eMudhra revoked all 16 certificates associated with the affected keys as a precautionary measure.

After the incident, the company changed its approach and began generating keys without transferring them between hardware security modules. Furthermore, eMudhra announced its exit from the digital certificate business, publicly apologised and announced an expert review to address security concerns.