> However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business

Scrutiny is inversely proportional to bit complexity of the private keys they used. Without a failure to apologize or expose how it happened: a human mistake, process mistake, etc. this looks pretty bad on them.

> eMudhra’s global SSL/TLS infrastructure runs separately from its other operations. The company’s Global digital signature certificate (DSC), eSign, and other signing services, including those in India, its enterprise PKI Solutions (emCA, CertiNext platforms), emSigner eSignature Suite, and its identity and authentication solutions (SecurePass, emAS) are not affected and continue to operate as normal

Anyone relying on them with anything related to security or trust is playing Russian roulette at this point.

It was "multiple human errors". But yeah no matter what, in any case or exceptional circumstances, this thing was not supposed to be screwed up.

On Mozilla’s tracker, eMudhra said the keys were created on 30 April 2025 in a key generation ceremony, a recorded procedure in which keys are produced inside hardware security modules (HSMs), tamper-resistant devices built to hold keys. The keys were meant to be moved to data centres in the United States and Europe for customers needing data stored in those regions. To move them, the company added a step to ‘wrap’ each key, or encrypt it for transfer, and ‘unwrap’ it at the other end. eMudhra said a flaw in the software script created a second, weaker set of keys during this step, and because the two sets had similar names, staff used the weaker ones by mistake. It said human errors occurred at multiple steps.

source:

What's the eMudhra security scare that has rattled the internet?

https://theprint.in/tech/whats-the-emudhra-security-scare-th...

Their complaint about social media reeks of "and we would have gotten away with it, if it wasn't for those meddling kids". [1]

[1] https://www.youtube.com/watch?v=hXUqwuzcGeU

"out of proportion to SSL/TLS’s place in our business" is an insane comparison. They are saying they care so little about SSL/TLS to begin with that it's not fair.

It would be like me practicing surgery 1 hour a week and saying "well surgery only has a very small place in my 80-hour work week" in response to flagrant failure of medical care.

Various Indian regulations (particularly around commerce and banking) require you to use India companies for solutions like the above. It gets worse when companies are "steered" by a regulator/compliance person who has a bias for a specific solutions provider.

Their OTP solution is bruteforceable as well: https://mastodon.catgirl.cloud/@49016/117475921584308861

This is what I found regarding how it happened, but still not a full explanation - but there was some name confusion and obvious incompetence.

>According to eMudhra, proper strong keys were created in the HSM at the key ceremony on 30-04-2025. The script had been changed to test wrapping and unwrapping keys, because the intermediates were to be moved to data centres in the US and Europe, and a bug in that change created a second set of weak keys. The keys had almost identical names, and the weak ones were used for the certificate requests. The same request was signed by eMudhra's own root and sent to Sectigo, which cross-signed it. The strong keys never made it into any certificate (Bugzilla).

https://www.fairssl.se/en/articles/emudhra-ca-noegler-knaekk...

Right? I don’t know why anybody would trust this company for anything.

Russian Roulette is pretty accurate if not an understatement.

If they expect people to still trust them on their other services they have obviously no clue on how Trust works, meaning they shouldn't be in the game in the frist place.

As a trust provider you get one chance. Squander it and you're out. That is how it should be.

Anyone relying on them with anything related to security or trust is playing Russian roulette at this point.

In any legal dispute involving them, Exhibit A will be "look at how they ran their SSL/TLS business". That won't go well.

They got their image hurt, and pulling the culturally appropriate response here which is to never apologize and to never accept fault. Instead quit/resign and say that other stuff is just fine. It's really not fine, and you can bet that the same corporate philosophy that made the CA error will have serious security errors in their other products.

> Without a failure to apologize

Unsurprising if you are familiar with the indian honor code „izzat“. To quote an old kiwifarms thread:

Hi. I didn't see this term mentioned in the thread, so I wanted to share this all with you. It's about Izzat. Some posts have mentioned 'saving face', which is Izzat, but I wanted to elaborate on it.

Izzat has no direct translation into English. We only have terms that can broach the same concept such as 'honour' or 'reputation' or 'face'. Izzat is so much more than that. It's a zero-sum game of collective honour shared by whole groups of people, all of whom take it very, very seriously. A system like this isn't just foreign to Enlightenment values, but I'd argue it's antithetical to every sensible form of governance on the planet. It will destroy any system that assumes good faith.

Izzat conflicts are not about who is right and who is wrong. It's about who wins and who loses. This means it's a zero-sum game where just about any action is justified (including murder) to restore the lost Izzat. Izzat is a limited social currency and the easiest way to get it is to take it from someone else. Winning is righteous in Izzat. Losing is unrighteous. This means that if someone plays the game of izzat well enough, they can get away with just about anything (murder, rape, scamming, cheating, stealing). The only morality in Izzat is the protection of your group's collective ego. The only appropriate response when your Izzat is attacked is the complete destruction of whoever insulted it.

Two people get into an argument. They might escalate, but chances are it won't be that bad. i.e. 'Sorry I broke your garden gnome.' With two Indians in an argument, the stakes are always deadly thanks to Izzat. Neither of them can back down, nor can they admit fault. Admitting fault is seen as deliberately humiliating yourself. Not only that, but because Izzat is shared, you are shaming everyone who shares your Izzat. So, admitting fault or taking responsibility for a problem is a form of social suicide. This means even if the dispute was over something completely fucking stupid or trivial (like a broken garden gnome), it could spiral into a decades long honour feud. Izzat is also the reason why police are reluctant to get involved in disputes. Because Izzat is a zero-sum game, all participants are involved in the game. If a policeman sides with one family over another in an Izzat dispute, this means that he's deliberately taking the side of that family and dishonouring the other. This marks him for retribution by the offending party. Without parties being able to be impartial, then centralized authority cannot effectively function.

Let's say someone in India complains about a broken water pipe. Instead of the problem being addressed, the official responsible for the water pipe denies it's a problem and counterattacks him instead, because daring to question his efficacy in his role was challenging his Izzat. So the official destroys the person who brought the problem up. The water pipe never gets fixed.

Izzat is also the reason why Indian managers are so infamous for hiring more Indians. It's because from the manager's perspective, he's using his position to gain an invisible social currency. Merit and actual qualifications come second to that idea. If he hired a westerner, he would not gain or even lose Izzat by doing so. He has a very strong cultural incentive not to be impartial. Meanwhile, if he can strong-arm dozens of Indians into a company, he is gaining huge quantities of Izzat and conspirators who owe an absolute debt to him.

It's not uncommon to see Indians gloat about their success in the west. And yes, izzat is very much a system that enables short term success. But the fundamental reality is the prosperity that these Indians find so attractive in the first place wouldn't exist if the west practiced something similar to Izzat. Our systems can only exist on the assumption of good faith, and not a majority of people exploiting them for destructive short term gain. On top of that, if an Indian causes the systems and companies he comes into contact with to collapse, then he can just go back to India with his plunder. He has no stakes in the long-term prosperity, functionality or stability of these systems. The stakes are completely asymmetrical in the Indian's favour.

You all know about that infamous video of that Indian scamming a food bank. Once again, winning is righteous. Losing is not. By employing 'clever' means (jugaad), he successfully extracted more resources for himself and his family. From the perspective of jugaad, a rule is not something to respect, but merely an obstacle to the Indian's own gain. Since he cheated the system and wasn't caught, he is seen as a righteous and dignified man in the Izzat framework.

I read a story in India about a man offering to pay another man to use a public toilet instead of defecating openly. The latter left and came back with several friends and beat the former to death. The problem was not that he was defecating openly, but that he was criticised for doing so. And with Izzat, it's not an eye-for-an-eye. Izzat is often an eye-for-a-whole-head. Disproportionately and brutally annihilating your enemies is the correct move to make because you take back your lost Izzat and then some. This kind of vindictiveness would be rightly seen as horrifying and disgusting in most of the world.