Rogue CA generation details questions about hashclash HOT 3 CLOSED

You need to be able to craft your own certificates.
Then you need to decide where to put the collisionblocks. Before that point you can freely choose the content of each certificate, after the collisionblocks they need to be the same.

For the rogue CA we put the collision blocks at the end of the certificate in a comment field.
For the web cert signed by a CA the format was very strict, so the collision blocks needed to be put in the public key field. We used a very long domain name to align the structures between the 2 certificates.

We then generated a 3-block chosen prefix collision using 215 PlayStations3.
Only after that, did we exploit the remaining bits of the public key to make it a complete modulus of which we knew the factorisation.
Note that it doesn't need to be a secure RSA key with two equal size random primes, you just need to be able to generate a signature that will be verified correctly.

from hashclash.

This is all public record and detailed in the our 25c3 talk and our CRYPTO 2009 paper.

from hashclash.

Many thanks, I'll read it!

from hashclash.