eMudhra incident troubling, government must take action: Rajeev Chandrasekhar

BJP Keralam State President Rajeev Chandrasekhar on Thursday termed the eMudhra digital certificate security incident troubling, stressing the need to strengthen safety and trust in digital infrastructure and urging the government to investigate the matter and take action against the company.

BJP Keralam State President Rajeev Chandrasekhar on Thursday termed the eMudhra digital certificate security incident troubling, stressing the need to strengthen safety and trust in digital infrastructure and urging the government to investigate the matter and take action against the company. Speaking to ANI, Chandrasekhar said digital certificates and keys are designed to protect websites and documents, and weaknesses in their generation raise concerns about the reliability of digital security mechanisms.

"This is certainly a troubling piece of information because these certificates are meant to protect whether it's a website or a document and that somebody, a company was doing such a weak job of it," he said. "I hope the government looks into it and certainly takes action against this company," Chandrasekhar added.

The incident concerns eight intermediate certification authority keys associated with e-Mudhra that were found to be cryptographically weak due to flaws in key generation. The weakness could potentially allow attackers to derive the private keys and misuse them to create fraudulent digital certificates, impersonate legitimate websites and facilitate phishing or other cyberattacks. Digital certificates are a key component of public key infrastructure (PKI), which enables browsers and other systems to verify the identity of websites and establish secure connections. If certificate authority keys are compromised, attackers could potentially exploit the trust placed in those certificates.

The issue relates to weak key generation rather than a demonstrated break in the underlying cryptographic algorithm. Browser providers, including Google and Mozilla, have taken steps to distrust affected certificates to prevent potential misuse. The incident has also raised concerns about the need for stronger technical safeguards and oversight of digital trust infrastructure, given the role certificates play in securing online transactions and communications.

Chandrasekhar's remarks come amid scrutiny of the security of digital certificate systems and calls for accountability when vulnerabilities emerge in infrastructure that underpins online trust. The government has been urged to examine the circumstances surrounding the incident and determine whether further action is warranted. (ANI)