In the paper itself, they reach the opposite conclusion: "Question. Suppose that a criminal creates by our method his own rogue Certification Authority that i

In the paper itself, they reach the opposite conclusion: "Question. Suppose that a criminal creates by our method his own rogue Certification Authority that is trusted by all browsers. Are then only websites with certificates from the CA whose signature he used vulnerable to impersonation attacks? Are only websites with certificates based on MD5 vulnerable to impersonation attacks? Answer. No. When a criminal uses redirection attacks in combination with a rogue but trusted CA certificate, all websites are equally vulnerable."