New Delhi

The Ministry of Electronics and Information Technology (MeitY) on Wednesday said it has constituted a special team to investigate a security incident at eMudhra, whose digital certificates help browsers confirm that a website is genuine.

The reported security incident largely pertains to global certificate biz, and the impact on Indian sites and applications are "very limited", it said in a statement.

The statement from the government assumes significance as Indian digital certification authority eMudhra has revealed that private keys associated with its certificates have been compromised, which verify trusted digital assets and ensure secure online data transmission. The shocking disclosure came after an advisory from the cybersecurity watchdog CERT-In.

In the statement, the IT ministry also called out some social media accounts that it said were "indulging in fear-mongering about the impact of this incident".

Laying out the "facts of the case", the IT ministry said eMudhra operates in two distinct areas. The first is the issuance of Digital Signature Certificates and eSign services, which are regulated by the Controller of Certifying Authorities (CCA) under MeitY.

The second is the issuance of digital certificates trusted by major browsers and operating systems, used to secure websites, software and online communications.

The second function is international in nature and operates under a global trust framework, the ministry said. It is governed by international standards and subject to independent audits, including WebTrust audits conducted by BDO International Limited.

The ministry said the reported incident pertains only to this global function, and that MeitY is not involved in its audit.

"The impact of this incident on Indian websites and applications has been very limited and for a very short interval," the ministry said.

It stressed that Digital Signature Certificates and eSign services regulated by the CCA remain completely unaffected.

The Indian Computer Emergency Response Team (CERT-In) has issued an advisory on the incident, including mitigation measures. MeitY said it remains engaged with all stakeholders to resolve the matter at the earliest, and that further details will be shared once the investigation is complete.

eMudhra issues certificates for digital signatures that are used for several online transactions by all kinds of business entities. PKI consists of several components, including public and private keys, for digital assets in mathematical codes used for encryption, digital certificates issued to websites as a mark of trust, etc.

TLS (Transport Layer Security) certificates, popularly associated with HTTPS websites, are a set of security protocols that ensure data transmission among digital assets, like browsers and apps, in a secure manner.

eMudhra, in a statement, also clarified that the incident has no connection with eMudhra's Indian Digital Signature Certificate (DSC) and eSign businesses but affected a small part of global TLS business.

"eMudhra Limited, an India-based Certification Authority (CA), has reported a compromise of private keys associated with eight intermediate CA certificates in its public key infrastructure (PKI), comprising six TLS certificates and two code-signing certificates," the CERT-In note said.

The disclosure led to fear that the compromised keys can be used by cyber criminals to develop a fraudulent online platform impersonating any genuine payment entity and lure people to make payments.

eMudhra said that its infrastructure was not compromised, no data was breached, and all physical and logical security controls of the firm remained intact.

"The affected global TLS business is a very small part of eMudhra's operations and accounts for around 1 per cent of the company's revenue. However, this may have some reputational risks for eMudhra, which cannot be quantified.

"eMudhra is working directly with customers who may be affected to give them replacement certificates, so that critical services are not disrupted. The company is also working with the root programmes and continues its root-cause investigation," eMudhra said.

eMudhra said a flaw in its system led to the creation of a set of weak keys alongside the original strong keys. A researcher had reported to Apple, Google, Microsoft and Mozilla that the weak keys could be reverse-engineered possibly with AI-assisted techniques.

ALSO READ: Why must the Muslim way of life be streamlined with constitutional values?

CERT-In said Google has blocked the public keys of the affected TLS intermediates in Chrome through a Certificate Revocation List Set (CRLSet) update. Mozilla blocked the six affected TLS intermediate certificates of eMudhra.