Agencies urged to replace TLS certificates

DATA VULNERABILITY: The incident has not caused any cybersecurity breaches so far, but agencies should replace their TLS certificates by tomorrow, the MODA said

• By Shelley Shan / Staff Reporter

• • Add TT as Preferred Source

The Ministry of Digital Affairs (MODA) has urged government agencies to promptly replace their transport layer security (TLS) certificates issued by Taiwan-CA Inc (TWCA) after discovering that the certificates did not meet international standards for cryptographic randomness.

The ministry issued a statement on Monday, saying that the developer of Bugzilla, a Web-based bug-tracking and testing tool used by the Mozilla project, on Friday last week informed it that some TWCA-issued certificates failed to meet the international requirement of at least 64 bits of cryptographic security for random number generation.

“Although TWCA designed the certificate serial numbers to be 128 bits long, only the first and last 12 bits contain actual random values, while the middle bits are fixed. As a result, the serial numbers have only 24 bits of actual randomness,” the ministry said.

The Gmail app icon is pictured on Oct. 27 last year.

Photo: Reuters

The ministry subsequently ordered TWCA to issue replacement certificates that comply with international standards within two days. It also notified government agencies that they must replace their certificates promptly to avoid disruptions to access their official Web sites.

TLS certificates are used to secure communications between Web browsers and servers, ensuring that data transmitted between them is protected, the ministry said.

Private companies also use certificates purchased from TWCA, it added.

The incident has affected 9,772 TLS certificates used by 962 government agencies, the ministry said.

TWCA issued all 9,772 replacement certificates by Sunday, with the new serial numbers meeting the international requirements for randomness, the ministry said.

As of Monday night, 926 certificates had been replaced, it added.

In addition to e-mailing the replacement certificates to the agency representatives who requested the new TLS certificates, the ministry said it had instructed the chief information officers of government agencies to oversee the replacement process.

The ministry pledged to closely monitor the progress to ensure that all affected agencies complete the replacement.

Although the incident has not caused any significant cybersecurity damage so far, all government agencies should replace their TLS certificates by tomorrow. Otherwise, visitors to their official Web sites could encounter security warning messages, the ministry said.

“We have commissioned an independent third party to inspect TWCA’s processes for producing and managing TLS certificates. The company must improve its operations based on the inspection’s findings,” the ministry said, adding that it would fine and rule compensation from TWCA for breaching the terms of its contract.

Established in 1999, TWCA commands more than 80 percent of a market share of the financial and securities sectors. Backed by major institutions such as the Taiwan Stock Exchange and Taiwan Depository and Clearing Corp, it provides critical digital security services, including SSL/TLS Web site certificates, identity verification, financial electronic certificates, and legally compliant electronic signature and timestamping solutions.