Why in News?
Eight private keys of “intermediate” certificate authority certificates issued by Bengaluru-based eMudhra Ltd were leaked, because they were weak (a number between 1 and 256 instead of a 384-bit key). Browsers and operating-system makers rushed to patch systems to stop trusting the affected certificates. eMudhra is the only Indian root certificate authority trusted globally, and several government sites (e.g., UIDAI, the Income Tax filing portal) use its certificates or technology. MeitY set up a special team, saying Digital Signature Certificates (DSCs) and eSign regulated by the CCA are unaffected.
UPSC Relevance
GS III — Science & Technology/Internal Security: cybersecurity, cryptography, digital public infrastructure, critical information infrastructure.
GS II — Governance: IT Act, 2000 regulators (CCA, CERT-In), e-governance trust.
Cryptography and Public Key Infrastructure (PKI)
Cryptography is the technique of securing information using mathematical algorithms to ensure confidentiality, integrity, authentication and non-repudiation.
Types of Cryptography
| Type | Working |
| Symmetric-key cryptography | Same secret key is used for encryption and decryption |
| Asymmetric/public-key cryptography | Uses a mathematically related public–private key pair |
| Hashing | Converts data into a fixed-length digest; not reversible encryption |
Public-Key Cryptography
- Private key: Kept secret; used to create digital signatures.
- Public key: Shared openly; used to verify digital signatures.
- Digital signature: Helps establish authenticity and integrity of digitally signed data.
For example, a website uses a digital certificate to associate its identity with a public key, helping browsers authenticate it during a secure HTTPS connection.
What is PKI?
Public Key Infrastructure (PKI) is the framework of technologies, institutions and procedures used to issue, validate and manage digital certificates.
Its main components are:
- Root Certificate Authority (CA): The trust anchor at the top of the certificate chain.
- Intermediate CA: Issues certificates under the authority of a root or another authorised CA.
- Digital certificate: Binds an identity, such as a domain name, to a public key.
- Certificate revocation: Withdraws trust in a certificate before its expiry when it is compromised or otherwise invalid.
Connection with the eMudhra Incident
The incident involved weakly generated intermediate CA private keys.
- Secure public-key cryptography depends on private keys being unpredictable and secret.
- If a private key is generated from a tiny set of possible values, an attacker can discover it through brute force.
- A compromised intermediate CA key may allow fraudulent website certificates to be created.
- Revocation and browser distrust help contain the damage.
Key lesson: Even a strong cryptographic algorithm becomes insecure if key generation or implementation is defective.
| What is a digital certificate: A signed electronic credential that proves a website or person is genuine. Web security (SSL/TLS) certificates enable HTTPS, the padlock in your browser. They rest on Public Key Infrastructure (PKI): a pair of keys, a public key (shared) and a private key (kept secret). |
Chain of trust
- Root CA (certificate authority) is trusted because browsers and operating systems (Chrome, Mozilla, Microsoft, Apple) pre-install it in their root stores.
- Root signs intermediate CAs; intermediates sign end-entity (website) certificates.
- If an intermediate’s private key leaks, anyone can forge certificates that browsers would accept, enabling impersonation and interception.
What went wrong
- A flaw in the key generation ceremony (the controlled process used to create CA keys) produced a second set of weak keys; the weak keys were the ones published to root stores.
- A 384-bit key has an astronomically large number of possibilities; a number from 1 to 256 can be guessed instantly. One key was reported as the number 4 preceded by 383 zeros.
- eMudhra says none of the affected intermediates issued end-entity certificates and only one was ever deployed in production; its root certificates show no sign of compromise. Six affected certificates were for TLS trusted across major root programmes.
Who regulates what
- Controller of Certifying Authorities (CCA) (under MeitY, IT Act, 2000): licenses CAs for Digital Signature Certificates and eSign in India; the Root CA of India sits here.
- Web (TLS) certificates operate under a global trust framework set by browser root programmes and industry baseline rules, so trust is granted internationally, not by the CCA.
Why it matters for India
- India’s sole globally trusted root CA is involved; trust built slowly can be lost quickly.
- History: after “rogue” certificates were issued in July 2014 via the National Informatics Centre’s authority, global browsers became reluctant to trust Indian roots.
- Clean-up risk extends to IoT devices and software that are rarely patched.
Way forward
- Strict, independently witnessed key ceremonies using hardware security modules, with audits.
- Certificate transparency monitoring and automated, “crypto-agile” certificate management to replace keys quickly.
- Clear incident-disclosure rules and coordination between MeitY, CCA and CERT-In (Indian Computer Emergency Response Team).
- Diversify trust anchors; build patching pipelines for IoT and public-sector systems.
Prelims MCQ
Q. With reference to digital certificates and Public Key Infrastructure (PKI), consider the following statements:
- The security of a certificate authority depends on its private key remaining unknown to outsiders.
- In the chain of trust, the root certificate sits below the intermediate certificate.
- Under the Information Technology Act, 2000, the Controller of Certifying Authorities (CCA) licenses and regulates Certifying Authorities that issue Digital Signature Certificates.
Which of the statements given above is/are correct?
(a) 1 and 2 only
(b) 2 and 3 only
(c) 1 and 3 only
(d) 1, 2 and 3
Answer: (c) 1 and 3 only :
Statement 1 is correct: A Certifying Authority (CA) uses its private key to digitally sign certificates. If an unauthorised person obtains this key, they can forge fraudulent certificates, undermining trust in the CA.
Statement 2 is incorrect: The root certificate is at the top of the chain of trust, not below the intermediate certificate. The root CA certifies intermediate CAs, which may issue certificates to end users.
Statement 3 is correct: Under the Information Technology Act, 2000, the Controller of Certifying Authorities (CCA) licenses and regulates Certifying Authorities that issue Digital Signature Certificates (DSCs).
Tell Google you want more of this.
Add Anantam IAS as a preferred sourceOne tap, and this site shows up more often in your own Top Stories, AI Overviews and AI Mode. Remove it any time.
