Subject: Re: draft-ietf-pkix-warranty-extn-01.txt

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 28 Nov 2002 18:28:52 +0100

Hi,

After reading this draft I believe the name "warranty" is a bit
misleading.  It is, (or should IMHO at least be), focused on
CA liability issues as a CA cannot be compared to a car maker,
as the only the latter will repair or replace their products in case
of faults.  Well, to get a "replacement" certificate would be the
equivalence but that is sort of taken for granted anyway. :-)

                  CA-liability-extn

seems to be closer to what we are actually dealing with.

I would also be very cautious about RP "risk management"
because that's rather fictional.  The risk you take by accepting
an unknown[*] business partner is likely to be magnitudes bigger
than accepting their certificates.   If the CA is unknown as well
you have nothing to build PKI trust on either.

For TTP CAs OTOH, "risk management" with respect to
client-certificates is a part of their daily bread.

Just my 2 öres

Anders

*] with respect to performance, trustworthiness, credibility etc.

---

From: "Alice Sturgeon" <[email-masked]>
Date: Thu, 28 Nov 2002 14:36:47 -0500

Anders,
I respectfully disagree.  You're right that a CA is not like GM or Ford, but
why can a CA not offer a warranty?  Perhaps what is missing here is a
definition of warranty, which, in insurance terms, is attestation of the
intent to provide compensation for harm incurred by using a certificate
(that is, a certificate that is faulty in some way).  Warranty is not the
same as liability; warranty is something that the CA can control, whereas it
cannot completely control liability.  The CA (or indeed any product- or
service-offering company) may try to limit its liability, but regardless of
this attempt, the extent of liability will ultimately be decided by the
courts.
You seem to be defining warranty rather narrowly, as replacement or refund
in the event of an inherent flaw.

Similarly, it seems to me that I define risk management more broadly than
you suggest.  Every time an RP enters into a transaction, or considers doing
so, the RP makes a risk management decision.  This can be quite a natural
and intuitive process, or it can be explicitly defined; either way, the
decision is made, and it will be based on more or less information.  The
more information an RP has, the more informed the risk management decision
will be.  If a certificate contains information pertaining to the existence
of compensation in the event of harm, then the RP has more information on
which to make a risk decision.  Armed with this information, as well as
information about other factors of the transaction, such as value,
sensitivity of information, parties to the transaction (e.g., known or
unknown), etc., the RP's risk is reduced by virtue of knowing more about all
of the risk factors - including warranty.  If there is a TTP involved, this
again becomes a factor in the RP's risk management decision.

My 2 Canadian cents again.

Alice

Alice Sturgeon
Chair
Canadian Advisory Committee - Information Technology Security
ISO/IEC JTC1 SC 27
and
System Policy Architect
SPYRUS
Phone:     613-232-2350
Cell:         613-291-0331

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of Anders Rundgren
Sent: November 28, 2002 12:29 PM
To: [email-masked]
Subject: Re: draft-ietf-pkix-warranty-extn-01.txt

Hi,

                  CA-liability-extn

Just my 2 öres

Anders

---

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 28 Nov 2002 22:19:13 +0100

Alice,

I do sympathize with the idea, but I maintain that it is not fully
recommendable to mix warranties and liabilities as they are
at least are perceived as different.

CA liability do address a serious commercial aspect.  Very few
CAs are likely to go beyond liability due to the following reasons:

A problem with a "warranty" worth its name, is that it must cope
with transaction-accumulation, which is technically impossible
to support.  An identity thief performing massive parallel attacks
of some kind, like sending fake purchase orders to different parties,
will erode any valid reason for having a warranty in the form we
usually define it.

A car can only break down once at a time, while PKI break-downs
can be like forest-fire.

Another problem with "warranties" is that not everything have an
a priori known value.  Like authentication.

Also I don't think this is how PKI is actually used (or even should be
used for that matter), you'd rather accept a CA or not.

If you split the ID in two pieces I'm sure that at least the liability-ID
could be a real success.  If lawyers accept the liability extensions
(it is really reductions...) in case of a lawsuit that is.  Otherwise
the whole thing gets redundant.

cheers,
Anders

PS It must be a challenge to be "Alice" in the world of PKI
where "Bob and Alice" are the two main players :-) DS

----- Original Message -----
From: "Alice Sturgeon" <[email-masked]>
To: "Anders Rundgren" <[email-masked]>; <[email-masked]>
Sent: Thursday, November 28, 2002 20:36
Subject: RE: draft-ietf-pkix-warranty-extn-01.txt

Anders,

Alice

Alice Sturgeon
Chair

-----Original Message-----

Hi,

                  CA-liability-extn

Just my 2 öres

Anders