How on earth did this happen:
The Indian certificate authority (CA) eMudhra had one job (well, two):
- Create secure, 384-bit private keys
- Store these securely and do not leak them
Well, eMudhra chose private keys between 1 and 256 (the numbers!!) and called it a day. WTF
LLinus MixsonXView on XI don't really understand why this would happen. It seems higher-effort than standard key generation.
0
2 comments
and they unleashed an absolute security nightmare.
This is SO BAD that I don't even have words.
Can a CA be made a non-CA after proving they are unable to do their job?
Nothing can explain this level of incompetence.
As predicted by xkcd in 2007
https://xkcd.com/221/