A weak key is an event. A weak feedback loop is a condition.
Eight eMudhra CA keys could be recovered by trying fewer than 256 values each. (A good P-384 key has ~10^115 possibilities.) The algorithm was fine; generating or selecting the key wasn't.
Across seven public Bugzilla reports (different severities, no proven common cause), one question recurs: was the rule enforced, verified, and tested after the fix?
Timeline and sources: https://banbreach.com/insights/emudhra-certificate-incidents/?utm_source=mastodon&utm_medium=organic_social&utm_campaign=controls_on_trial_01&utm_content=thread_pattern #InfoSec #PKI #Java
BanbreacheMudhra CA Key Compromise: Timeline, Java Impact, Lessons | BanbreachSeven Mozilla bug reports on eMudhra, eight recoverable CA keys and Oracle’s removal of its roots from Java. A sourced timeline and what to ask providers.