Post

Chrome's removal of the eMudhra root is due to reach every device today. The part I keep coming back to: those keys came from a formal, audited ceremony on certified hardware. Debian's weak keys in 2008 came from trusted open source software. ROCA's, in 2017, came from a certified chip.

Jamie Taylor

@gaprogman.com

In every case the process was respectable and the output was broken. Audits certify that a process exists. Only checking the output tells you whether the key is actually random. rjj-software.co.uk/blog/emudhra...

rjj-software.co.ukA CA Private Key of 4: What eMudhra Teaches Us About TrusteMudhra CA key compromise: one key was the number 4. What a CA does, why this keeps happening, and what to check by 27 October.

27/10/26, 3:01 pm0 reposts0 likes

No replies yet.