TWCA Certifies Weak Random Numbers, Urges Immediate Replacement Within Two Days

On October 30, the Ministry of Digital Affairs received a report indicating that the "serial number random number length" of certain certificates issued by the Taiwan-CA Inc. (TWCA) failed to meet the international standard of cryptographic secure random numbers requiring 64 bits or more. This revelation exposed a vulnerability in the random number generation mechanism during the certificate production process, which could reduce the certificates' resistance to cracking and pose a potential risk to overall cybersecurity. The Ministry of Digital Affairs immediately requested TWCA to complete the production of compliant new certificates within two days and urged all agencies to update their usage as soon as possible to prevent security incidents arising from the exploitation of old certificates.

As Taiwan's primary certificate authority, TWCA is responsible for issuing digital certificates to ensure the security of online transactions, electronic signatures, and identity authentication. According to universally accepted TLS/SSL certificate standards, serial number random numbers must possess sufficient entropy, with 64 bits or more serving as the minimum security threshold to ensure that serial numbers cannot be predicted or duplicated. If the serial number length is insufficient, attackers can employ brute-force cracking or reuse identical serial numbers to impersonate legitimate certificates, thereby posing a severe threat to critical areas such as financial transactions and government data exchanges.

To ensure compliance and hold parties accountable, the Ministry of Digital Affairs has initiated breach-of-contract investigation procedures. The investigation will target TWCA's regulatory violations during the certificate generation process and impose fines and compensation in accordance with contractual terms. This action not only demonstrates the government's emphasis on cybersecurity but also sets a strict compliance standard for the industry. If the investigation results show that TWCA committed gross negligence, related penalties could reach millions of New Taiwan Dollars, and the company will be required to publish an improvement plan to restore public trust.

For financial institutions, e-commerce platforms, and government agencies at all levels, certificate security is the foundation for maintaining transaction legitimacy and information confidentiality. Continued use of legacy certificates will entail risks such as data breaches, intercepted transactions, or identity impersonation. Many banks and securities firms have already established automated update mechanisms within their internal cybersecurity systems, requiring them to promptly incorporate the new TWCA certificates into use to avoid service interruptions caused by certificate invalidation. This incident also serves as a reminder for enterprises to strengthen risk assessments of their certificate supply chains, preventing technical flaws from a single vendor from impacting overall operations.

From a macroscopic perspective, Taiwan is actively promoting the development of a "digital economy" and "smart cities," with cybersecurity serving as one of the core infrastructural pillars. If such incidents are exploited by external attackers, they could undermine national trust in digital infrastructure and subsequently affect investors' evaluations of Taiwan's technology sector. By strengthening certificate security and regulation, the government demonstrates its determination to safeguard national cybersecurity and promote digital transformation, while also providing a more stable business environment for international investors.

(Source: Central News Agency)