eMudhra appoints KPMG to conduct independent review of security keys incident

New Delhi, Oct 30 (PTI) Digital certification firm eMudhra has appointed KPMG as its independent external reviewer for the web security key vulnerability matter, the company said on Friday.

    eMudhra issues digital signatures and website security certificates to enable them to securely connect to browsers for public access.

    "The appointment fulfils the commitment the company made in its press release of October 21, when it said an independent entity would examine the matter. KPMG is among the leading global networks of professional services firms," the company said in a statement.

    The vulnerability was discovered by cybersecurity researchers who shared the findings with Apple, Google, Microsoft and Mozilla that the weak keys could be reverse-engineered possibly with AI-assisted techniques.

    eMudhra said that its infrastructure was not compromised, no data was breached, and all physical and logical security controls of the firm remained intact.

    The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate the incident at eMudhra.

    CERT-In said that the issuance of digital signature certificates and eSign services, regulated by the Controller of Certifying Authorities under MeitY, are not impacted.

    "We said on October 21 that someone from outside the company would look at what happened, and we have now appointed KPMG to do that. Our customers and shareholders should be able to rely on the findings, and we will act on whatever the review tells us," Kaushik Srinivasan, Co-founder of eMudhra, said.

(This story has not been edited by THE WEEK and is auto-generated from PTI)