Breaking Down Broken SSL

Researchers demonstrated in 2008 that chosen-prefix MD5 collisions can be used to create a rogue intermediate CA certificate, allowing issuance of fraudulent SSL site certificates that browsers would accept; the attack required significant compute (a PS3 cluster), advanced knowledge, and traffic redirection, and was facilitated by Certificate Authorities still signing with MD5 and predictable serial/validity practices. The report emphasizes the difficulty of detection once a rogue CA exists and calls for CAs to phase out MD5, add randomness (e.g., to serial numbers), and improve signing procedures.