eMudhra’s security lapse highlights need for homegrown technology to meet global standards

The eMudhra private-key leak should concern India for reasons beyond technical failure. Eight intermediate certification authority keys were found to have been generated with extraordinarily weak cryptographic randomness, with one reportedly being No. 4.

How it chose a number requiring only 3 bits, when the key size should be greater than 384 bits, is not a process gap but a failure of trust. This incident tests whether India's digital trust architecture can withstand a global scale.

Consider the regulatory push to move all banks to use bank.in top-level domain.


The objective is sensible: customers need a simple way to distinguish their bank's genuine digital presence from phishing and impersonation. Once citizens learn that bank.in signals a genuine bank, it becomes part of their fraud-detection system. If criminals can compromise the infrastructure behind that assurance, the mechanism designed to protect customers can be exploited to win their trust.

Certificate authorities sit beneath this visible layer of trust. They help browsers establish whether a digital connection is genuine, while remaining invisible to most users. Public certificate-transparency logs show eMudhra-issued certificates in the bank.in ecosystem. The trust signal that the state worked so hard to push stands compromised for banks that used eMudhra-signed certificates.

The device layer makes the problem more acute. Millions of Indians use older Android devices that no longer receive OS or certificate store updates. When certificates or trust anchors are revoked, protection depends on whether devices can enforce that decision. India could, therefore, have one national digital standard but unequal protection, determined by citizens' income and ability to afford newer phones.

India's sovereign push to own infrastructure powering its financial and digital economy is understandable. But sovereignty is increasingly measured through ownership, designation and control, when the harder test is whether India has the institutions and policy muscle to operate critical infra securely and competitively.

The state can run mission-mode sprints, aligning policy, capital and institutions to build national infrastructure quickly. The more successful digital infrastructure becomes, the more consequential, interconnected and harder to replace it is.

The eMudhra episode should sharpen our thinking about what lies ahead. If today's digital infra can expose gaps in resilience and institutional assurance, quantum computing and other frontier technologies will test those capabilities at an altogether different scale. India, therefore, needs a much deeper and wider digital moat, and it needs to build it soonest.

This is 'State+' and 'Status++ Sovereignty'. 'State+' begins with the legitimate objective of domestic ownership and control, but can quietly become the belief that ownership creates resilience. 'Status++ Sovereignty' is subtler. Once an institution is designated strategic, trusted or preferred, its status can substitute for demonstrated capability, and, worryingly, its importance makes sustained challenge and displacement harder.

The eMudhra episode should challenge that assumption. An elementary cryptographic weakness reportedly survived key generation, testing, assurance and deployment into a global trust ecosystem. Though the company says its systems underwent independent audits, the flaw was exposed externally, prompting technology companies to contain the risk.

The governance question is whether India's assurance mechanisms provide real assurance or mere compliance theatre, until an enterprising third party proves it is a societal farce.

Digital India's architecture risks substituting domestic protection for global competitiveness. In critical technology, competition is more than a contest for prices or market share. It corrects market failure by driving better engineering, stronger talent, external scrutiny and global benchmarking. Without that pressure, mediocrity can become entrenched.

Sovereignty cannot mean insulating Indian infrastructure from competition. Critical infrastructure needs adversarial testing, independent technical challenge, transparent accountability and exposure to the strongest global standards.

The eMudhra episode may ultimately be contained as a certificate-security incident. We often brush cyber incidents aside to avoid panic, but risk convincing ourselves that all is well. Its significance is the question it leaves behind: can India build infrastructure that is domestic in ownership, global in capability and resilient enough to withstand uncertainty, while becoming infrastructure that the world trusts and buys into?