# Rogue CA Certificate MD5 Collision Control

Papers from Marc Stevens et al show that X509 certificates that rely on MD5 signatures can break the assumed security model, that is, it allows for a forged certificate to have the same signature as a trusted cert, see https://marc-stevens.nl/research for these papers. Both methods require the "to be signed" portion of the certificate to be known in order for the collision search to begin. Both require some "control" over the CA, whether it is by setting a fake CA or correctly predicting the validity and serial fields.

My question is why is this necessary? I understand that I need to know the to be signed parts, but why can't I just get this information from an already generated cert? I must be missing something simple about how these certs are constructed.

The reason for this is because it is impossible to generate an MD5 for just any $y$, where $y$ is the output of any $x$ that isn't pre-computed. MD5 is broken but it is not completely broken. Using the common terms, MD5 is broken with regards to collision attacks, but not broken with regards to pre-image attacks.
So the attack that's most potent is to pre-generate a certificate request for *.kzs8wf.com and a certain crafted public key forming the pre-computed block. You then receive the resulting certificate and then modify it to a *.google.com certificate with an re-calculated public key forming the altered pre-computed block.