One of eMudhra's certificate authority private keys is the number 4.
Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their
I am not a an expert, but if I recall correctly it can take some time to seed the random generator of choice with enough entropy. This used to be true especially after boot. Maybe when testing they couldn’t set the entropy threshold to zero and did not want to wait for it. Kind of common if you are spinning up build containers/vms in CI/CD. Hence an hard-coded trivial key. Lots of maybes…
Is there a compelling reason to purposely generate weak keys on the hsm?
score 1 · canonical
No. Even during testing, that makes no sense to me.
score 1 · canonical
I am not a an expert, but if I recall correctly it can take some time to seed the random generator of choice with enough entropy. This used to be true especially after boot. Maybe when testing they couldn’t set the entropy threshold to zero and did not want to wait for it. Kind of common if you are spinning up build containers/vms in CI/CD. Hence an hard-coded trivial key. Lots of maybes…
score 1 · canonical