Chrome Root Program responds to "Comment 47"

[u/throwaway16830261]

On October 25, 2026 "A question for the Chrome Root Program" was posted in "Comment 47" at "eMudhra: Private key compromise of Intermediate Certificates" ("Bug 2083449"): https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c47

On October 27, 2026 in "Comment 50" chrome-root-program responded to "Comment 47" and the response is -- in my personal opinion -- informative, educational and encouraging: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c50

[u/throwaway16830261]

• Project Paranoid, "Paranoid project checks for well known weaknesses on cryptographic artifacts such as public keys, digital signatures and general pseudorandom numbers. . . .": https://github.com/google/paranoid_crypto

  • "Compromised eMudhra Intermediate Certificates": https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ (note "Wayne")

 

• "eMudhra: Invalid CRL signatures" opened on June 5, 2025 and closed on July 16, 2025: https://bugzilla.mozilla.org/show_bug.cgi?id=1970728

• "eMudhra: Private key compromise of Intermediate Certificates" opened on October 18, 2026: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 (note "Wayne")

 

• "Public Key Infrastructure (PKI)": https://gist.github.com/NoteAfterNote/0892db84c82e4f5107bc35a6931fa5de (NoteAfterNote-13)

  • "The PKI Definitions and Terms You Need to Know" by Ryan Sanders (June 18, 2020): https://www.keyfactor.com/blog/pki-definition-terms-to-know/ via https://gist.github.com/NoteAfterNote/0892db84c82e4f5107bc35a6931fa5de (NoteAfterNote-13, "Public Key Infrastructure (PKI)"), https://archive.ph/XU2Gf , https://archive.is/XU2Gf , https://web.archive.org/web/20260527232825/www.keyfactor.com/blog/pki-definition-terms-to-know/

  • "Hardware Security Modules (HSMs)" "@robert.broeckelmann" "There is a certain type of security engineer who hears the words Hardware Security Module and immediately pictures something the size of a washing machine, installed in a locked rack, surrounded by three layers of physical security, two security cameras, and a person whose entire job appears to be making sure nobody touches it. . . .": https://archive.ph/Ncbxx via https://gist.github.com/NoteAfterNote/0892db84c82e4f5107bc35a6931fa5de (NoteAfterNote-13, "Public Key Infrastructure (PKI)"), https://archive.is/Ncbxx