Synopsis
Weak cryptographic keys associated with eight intermediate certificate authorities operated by eMudhra could be reverse-engineered, or recovered, potentially allowing the issue of fraudulent certificates to impersonate websites or make malicious software appear trustworthy.
A security lapse at Bengaluru-based cybersecurity company eMudhra has raised a critical question about who oversees the security of certificates that help establish whether websites and software can be trusted. The incident has also drawn attention to the oversight of eMudhra’s international certificate business, which falls outside the audit purview of India’s digital signature regulator. Tanya Pandey explains what went wrong, who oversees the
Now Playing