Practical angle for platform teams: on 24 Oct, Oracle's JDK update removed eMudhra's G1, G2 and G3 roots from the default Java truststore. A precaution, not proof that all three roots were compromised, but it's how a CA incident becomes an application incident. Do you know which of your services trust which roots?
banbreach
-
A weak key is an event. A weak feedback loop is a condition.
Eight eMudhra CA keys could be recovered by trying fewer than 256 values each. (A good P-384 key has ~10^115 possibilities.) The algorithm was fine; generating or selecting the key wasn't.
Across seven public Bugzilla reports (different severities, no proven common cause), one question recurs: was the rule enforced, verified, and tested after the fix?
Timeline and sources: https://banbreach.com/insights/emudhra-certificate-incidents/?utm_source=mastodon&utm_medium=organic_social&utm_campaign=controls_on_trial_01&utm_content=thread_pattern #InfoSec #PKI #Java #eMudhra