eMudhra has published a statement related to an incident in which eight CA root certificates had easily guessable private keys that had only 1 byte of entropy instead of 48. eMudhra claims that the certificates were generated in April 2025 at a public ceremony using HSM (Hardware Security Module) hardware modules certified to comply with FIPS 140-2 Level 3 requirements.
There was a failure in the key generation process, due to which at the stage of packaging/unpacking in HSM (wrap/unwrap, encryption and decryption with a wrapper key) in addition to the main set of crypto-resistant keys, a second set of weak keys was created with the high bytes cleared, which was used in the certificates. The failure was not recognized because private keys are created and stored only in the HSM and are not sent in clear text outside of it. The cause of the failure is not yet clear and the company is conducting an investigation into the matter. It is stated that the problematic root certificates created using weak keys were independently audited and remained trusted in all root certificate stores for two years.