Compromised TLS Certificates

Indian certificate authority eMudhra Limited has issued eight TLS certificates with private keys that are extremely weak. The private keys have entropy levels ranging from 3 to 8 bits, which is significantly lower than the typical 384 bits found in NIST P-384 elliptic curve cryptography private keys. Normally, a 384-bit key would allow for a vast number of possibilities, but the compromised keys have much smaller sizes. The specific sizes of the private keys are 4, 56, 66, 115, 155, 156, 230, and 237 bits, which is astonishingly low. This weakness is surprising to engineers studying the incident, who are struggling to understand how such defective keys were generated. The compromised keys pose a significant security risk due to their weak entropy levels.