That's an entirely different thing. If you look at my article, I do explain this. But you can easily revoke them all by revoking the rogue CA's credentials. And, once the hole is plugged at the few CAs signing w/ MD5, that is all you have to do (tho it is best done in the browser, not through CRLs or OCSP). The Internet is not going to die. This is not a big deal.

I was talking about finding a new cert where the signature matches any arbitrary web site cert. That is, you can't take Citibank's cert and produce a new cert that says citibank that also has the same signature. I was mentioning this because most people seem to think that this is what the attack involves. The actual attack involves getting your own rogue CA by tricking an existing CA that signs using MD5 to sign a carefully crafted certificate. The actual attack does indeed work. It's been assumed this was approaching possible for a while, which is why most CAs long since moved to abandon MD5.

No, you misunderstand their attack. A CA definitely needs to be involved. You trick them into signing a web site cert, but then that signature can be pasted on to your other cert, which is a CA cert. You thus mint your OWN CA cert that a Thawte or whoever has accidentally endorsed, due to the collision you have generated. Note that this dependency on an existing valid CA is why there is a long section about how to anticipate the CA's serial numbers and validity periods.

You're wrong. Read the attack author's write-up here: http://www.win.tue.nl/hashclash/rogue-ca/ You will see that they absolutely need to get the CA to endorse the data they produce. They come up with two certificates in advance that, under the right conditions, will both validate when one of them is signed via MD5. That means, you cannot take an arbitrary cert on the internet and feasibly come up with an identical cert that is malicious, where the same signature applies.

Read the article carefully. Just because something is signed by MD5 doesn't make it broken. Signing future things with MD5 without proper randomization is bad, but I don't expect anyone other than the third tier CAs to do that kind of thing after this. I will also say that the attack will leave a pretty distinctive signature in CA logs. Plus, nobody would say "revoke Thawte's cert retroactively", but it should probably not be used anymore, and no CA certs issued with it should be accepted anymore. In fact, those issued over the last year, Thawte should publish which ones it issued separately. If browsers respected that list (a one-time thing), it would close the remaining hole (for Thawte... each CA affected would need to do the same thing).

A lot of people in the twitterverse seem to think otherwise, but this is not a major breakage of the Internet. See my commentary at O'Reilly: http://broadcast.oreilly.com/2008/12/the-sky-is-not-falling-on-toda.html