eMudhra八张中间CA私钥一秒内可还原
安全研究员Scott Helme表示，他从公开证书中不到一秒便还原了eMudhra八张受影响中间证书的全部私钥，其中包括六张TLS签发CA和两张代码签名CA，且均获Sectigo的AAA Certificate Services根证书交叉签名。Chrome、Firefox、Safari和Windows已采取封锁措施，Mozilla也通过NSS移除了eMudhra根证书；Helme另称Claude仅用一个提示词便还原了这些密钥。eMudhra则表示，事件源于密钥生成仪式错误，只有其中一张中间证书进入生产环境，未签发终端实体证书，根CA私钥也未受影响。
六张受影响中间证书可用于签发TLS证书，造成广泛的证书欺诈与信任库暴露风险，而Helme称Claude通过单个提示词还原密钥，也凸显了AI辅助密码分析的新安全维度。
One of eMudhra's certificate authority private keys is the number 4.
Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their public certificates on my laptop just now, and it took less than a second.
What happened
On Saturday 17th October a security researcher reported to Apple, Google, Microsoft, Mozilla and eMudhra that the private keys for eight eMudhra intermediate certificates were compromised. Chrome pushed a CRLSet update blocking them that evening and Mozilla blocked them in Firefox via OneCRL a few hours later. On Tuesday 20th, Mozilla announced it publicly and shipped an NSS update removing the eMudhra root, and Chrome confirmed the root is going in Chrome Root Store v43.
#eMudhra#Claude#Chrome#Firefox#Mozilla NSS#Apple Safari#Microsoft Windows#Sectigo AAA Certificate Services#emSign ECC Root CA - G3#Go