Poisoned Pipeline / Incidents / AS311
eMudhra intermediate CA keys recoverable in milliseconds; root distrusted
On 17 October 2026 a security researcher reported to Apple, Google,
Microsoft, Mozilla, and eMudhra that the private keys of eight eMudhra
intermediate certificates are trivially recoverable. Scott Helme's
20 October write-up: the keys are P-384 ECDSA, but each private scalar is
a single byte — 47 zero bytes plus one value (4, 56, 115, ...). Recovering
any of them from the public certificate is at most 255 point
multiplications, under a second on a laptop. The eight intermediates were
created April 2025: six TLS issuing CAs (DV, OV, EV, two generations each)
and two code-signing CAs, all cross-signed by Sectigo's AAA Certificate
Services root in May 2025. Whoever holds a key can mint certificates every
client trusts — TLS interception for any domain, or malware carrying an
eMudhra code-signing chain. Chrome pushed a CRLSet blocking the
intermediates the same evening; Firefox blocked them via OneCRL hours
later. On 20 October Mozilla announced the incident publicly and shipped
an NSS update removing the eMudhra root; Chrome confirmed the root goes in
Chrome Root Store v43. No rogue certificate issued from the weak keys has
been publicly reported — the compromise is the recoverable key material
itself, not an observed abuse. eMudhra's own account (Checkmarx Zero,
21 October) is that a wrap/unwrap step in the April 2025 key-generation
ceremony produced a second, weak set of keys alongside the intended
strong ones, and that only the weak set was published to the root
stores; it says one of the eight was deployed in production and none
issued an end-entity certificate.
Mapped techniques
supply-chain eMudhra CA keys
The two code-signing intermediates are real eMudhra identities
whose private keys anyone can recover. Malware signed with them
would verify as eMudhra. T0208 describes a stolen or issuer-trusted
signing certificate; here the identity is real and the key material
is effectively public.
The six TLS issuing intermediates have single-byte P-384 scalars.
Whoever recovers one (under a second of computation) can mint
browser-valid certificates for any domain until the root was
distrusted on 20 October 2026.
Sources
- https://blog.cloudflare.com/emudhra-certificate-compromise/
- https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/
- https://emudhra.we-have-a-problem.com/
- https://checkmarx.com/zero-post/eight-compromised-certificate-authority-keys-have-put-the-internet-at-risk/
- https://safedep.io/emudhra-ca-key-compromise
- https://www.aikido.dev/blog/emudhra-ca-compromise
- https://sansec.io/guides/emudhra-ca-compromise