Subject: RE: draft-ietf-pkix-warranty-extn-01.txt

From: [email-masked]
Date: Fri, 6 Dec 2002 10:41:13 -0700

the other problem in a commercial environment is with regard to
insurance/warrenty/liability represents an incremental cost of doing
business. In the contractual model, the customer (i.e. certificate owner)
pays for business costs (aka otherwise if a business is charging a customer
less than the cost of doing business .... they are loosing money).

frequently the insurance kind of warrenties may actually have the costs to
the customer (certificate owner) broken out separately. not only is the RP
left out in this model ... because of contractual conventions .... but also
the RP isn't involved in the paying for the cost of doing business to the
certification authority. It is even harder to imagine what kind of
incentive that an RP could give a customer (certificate owner) to have
(voluntarely) purchased the addtional insurance (other than the scenario of
home owner's insurance that there is a threat of the RP sueing the customer
because of some issue with the certificate).

it is more common in the liability kind of warrenties ... especially  when
gov/legally mandated that it is found such costs of doing business is
bundled into the basic product price (i.e. in this situation since it is
gov/legally mandated there is much more of a level playing field for all
companies offering the service/product).

there is some hypothesis that there might be different gov/lergally
mandated standards for certificates with different value limits. The
challenge in the traditional TTP CA model is that while the direct cost is
carried by the purchaser of the product (the consumer/certificate owner),
the whole thing is supposedly is primarily for the benefit for the RP ...
who is not part of the contractual relationship (and who isn't purchasing
the certificate, and therefor isn't directly contributing to the CA cost of
doing business).

Another issue is if a RP ever tried to collect under any such possible CA
warrenty can the CA legally disclaim all responsibility on the basis that
there is no contractual relationship between the CA and the RP.  That seems
to be where the gov. regulations come in .... that they can legislate any
sort of obligation they want to ... even if one wouldn't otherwise exist in
standard contract environment.

[email-masked] on 12/6/2002 10:15 am wrote:

Lynn, and others,
Looking at your last point first, if I were an insurer, I'd opt for the
aggregate model, being basically risk averse, to avoid getting slammed by
those one million ten-dollar transactions.  But this may be a matter of
knowing your community.  If that is the case, i.e., that the CA knows its
user community in terms of usage profile, then it might be comfortable in
offering per-transaction.  Thus both should be available.
On your two types of "warranties", I think you're using the wrong term for
your second type.
As I tried to categorize them earlier, liability really has nothing to do
with warranty.  In a dictionary sense, you might find a definition that
brings the two together, perhaps as analogous, but certainly in the legal
and insurance communities, they are very different indeed.
Your third paragraph offers a reason for having a warranty in a
certificate.
If it is in the certificate, then the RP is not left out.

Alice

Alice Sturgeon
Chair
Canadian Advisory Committee - Information Technology Security
ISO/IEC JTC1 SC 27
and
System Policy Architect
SPYRUS
Phone:     613-232-2350
Cell:         613-291-0331