There are lots of differences. The important one is the impact for dealing with the problem. If the signature for any cert in the world signed by MD5 could be stolen, then you couldn't trust anything with an MD5 signture and we'd therefore have to treat every web site serving up an MD5 cert as bad, which would cost lots of people time and money. With this attack, there's a very good chance that no bad guy will ever use the attack in real life, and even if they do, it is not too hard to identify and blacklist the few rogue CAs that will exist, which will automatically invalidate any fake certificates. Most web site certs out there today that were signed by MD5 are perfectly fine (probably through their entire validity period), and there is no need to incur the cost to have people replace them.

Actually, they should do both. Whether true or not, I have visions of the CA being written by one guy n years ago, and it's been on autopilot ever since. I can imagine that he's got a hardcoded 16 byte value somewhere, and it's easier for him to randomize a sequence number than to make sure he got hardcoded values right across his code base. If it were me, I'd have abandoned MD5 in 2004, when most other people did. But, with a large random value, it is a "good enough" solution until MD5 is fully broken. I'm not sure which will happen first, a full break on MD5, or the same kind of collision attack on SHA1 that the researchers used here. I actually suspect the answer is that SHA1 is more vulnerable to this kind of attack than MD5 is to a full break. SHA1 has the same structural weaknesses. The only thing saving it is the bit length. As the complexity of this attack on MD5 comes down from brute force (O(2^64)) we can expect it's coming down on SHA1 as well. Maybe this same kind of attack is feasible given a year of time on a much bigger cluster, or something like that. Yes, people here are going to misread this to think I mean MD5 is stronger than SHA1 (which it certainly isn't), but that's slashdot for you.

Your use of the word 'twitterverse' marks you as a complete douchebag.

That's an entirely different thing. If you look at my article, I do explain this. But you can easily revoke them all by revoking the rogue CA's credentials. And, once the hole is plugged at the few CAs signing w/ MD5, that is all you have to do (tho it is best done in the browser, not through CRLs or OCSP). The Internet is not going to die. This is not a big deal.

I was talking about finding a new cert where the signature matches any arbitrary web site cert. That is, you can't take Citibank's cert and produce a new cert that says citibank that also has the same signature. I was mentioning this because most people seem to think that this is what the attack involves. The actual attack involves getting your own rogue CA by tricking an existing CA that signs using MD5 to sign a carefully crafted certificate. The actual attack does indeed work. It's been assumed this was approaching possible for a while, which is why most CAs long since moved to abandon MD5.

No, you misunderstand their attack. A CA definitely needs to be involved. You trick them into signing a web site cert, but then that signature can be pasted on to your other cert, which is a CA cert. You thus mint your OWN CA cert that a Thawte or whoever has accidentally endorsed, due to the collision you have generated. Note that this dependency on an existing valid CA is why there is a long section about how to anticipate the CA's serial numbers and validity periods.

You're wrong. Read the attack author's write-up here: http://www.win.tue.nl/hashclash/rogue-ca/ You will see that they absolutely need to get the CA to endorse the data they produce. They come up with two certificates in advance that, under the right conditions, will both validate when one of them is signed via MD5. That means, you cannot take an arbitrary cert on the internet and feasibly come up with an identical cert that is malicious, where the same signature applies.

Read the article carefully. Just because something is signed by MD5 doesn't make it broken. Signing future things with MD5 without proper randomization is bad, but I don't expect anyone other than the third tier CAs to do that kind of thing after this. I will also say that the attack will leave a pretty distinctive signature in CA logs. Plus, nobody would say "revoke Thawte's cert retroactively", but it should probably not be used anymore, and no CA certs issued with it should be accepted anymore. In fact, those issued over the last year, Thawte should publish which ones it issued separately. If browsers respected that list (a one-time thing), it would close the remaining hole (for Thawte... each CA affected would need to do the same thing).

A lot of people in the twitterverse seem to think otherwise, but this is not a major breakage of the Internet. See my commentary at O'Reilly: http://broadcast.oreilly.com/2008/12/the-sky-is-not-falling-on-toda.html