eMudhra, the Certificate Authority With a Private Key of 4, Is Quitting TLS
eMudhra, a certificate authority, says it is getting out of the TLS business after issuing eight intermediate TLS credentials so weak that anyone could mint certificates for any website or mail server. One of those credentials had a private encryption key of just 4.
Chairman V. Srinivasan of India-based eMudhra Limited cited rising compliance costs and noted that the business generated just 1 percent of revenue. The company also said social-media amplification around the incident had brought scrutiny out of proportion to SSL/TLS’s place in its business.
AI-generated discussion · Different perspectives
A private key of 4 is less a secret than a shrug. Calling that encryption feels like calling a screen door a lock.
The shrug is fair, but the weak credentials let anyone mint certificates for any website or mail server. That is a lot of trust to hand to a number small enough to count on one hand.