Subject: Re: draft-ietf-pkix-warranty-extn-01.txt

From: [email-masked]
Date: Fri, 6 Dec 2002 06:47:07 -0700

basically companies are offering two kinds of warrenties ...

1) insurance ... if the product is defective you get replacement or
compensation. this is frequently marketing issue .... possibly when dealing
with marketing environment where competition may have more reliable product
... or otherwise differentiated themselves.

2) limited liability statement ...  legal &/or gov. have established that
there is some range/scope of liability ... and offers the provider
opportunity to state the limits of their liability. some of these
statements may include phrases about gov. regulations may offer additional
or other recourse.

#1 is almost always with regard to the direct purchaser of the the product
or service ...  and may even involve additional, optional fees. This leaves
out the RP ... unless there is some sort of insurance of the nature of home
owner's insurance that allows the RP to recover from the insurance policy
of the certificate owner.

#2 is frequently interpreted within the context of parties of a contract.
as mentioned before, this aspect of contract law creates a difficult
situation for TTP CAs with respect to RPs ... since RPs aren't party to the
contract between the CA and the end-user purchasing a certificate.  The
traditional legal recourse for the RP then is to sue the owner of the
certificate ... not the CA ... since there is some business operation
between the RP and the owner of the certificate ... but not between the RP
and the CA (at least in the traditional TTP CA model). The other approach
is the deep pockets .... if you are injured in a traffic accident ... sue
the company that manufactored the vehicle ... on the grounds the vehicle
was defective in some way. Some sort of standard is established as to what
might be considered defective and not defective ... and the manufactor of
the vehicle is typically not allowed to make statements regarding the
limitation of their liability.

Now, it is pretty obvious that in #1 ... the RP is recovering from the
certificate owner's insurance policy (which the certificate owner paid
for). The problem in #2 is either that it is a) specified gov. standards or
b) this seems to be some sort of new type of legislated legal relationship
... that doesn't seem to exist in most txisting contractual relationships
.... an implied contractual relationship between the RP and a TTP CA by way
of both of them having some relationship with the certificate owner.

If it is "2a"  ... then it isn't really a limited liability statement ....
it is a statement as to the type/class/kind of gov. standard certificate
(somewhat contrived to call it a warrenty).

The other downside (mentioned somewhat in this thread) comes in the area of
value and financial. It is pretty obvious that a certificate can state that
it is only for transactions that are less than some specific value. The
issue is that many kinds of electronic value transactions can be repeated
(aka aggregation). Can a ten dollar certificate be used for a million
transactions? What if it is used for a million ten dollar transactions with
the same RP?

[email-masked] on 12/6/2002 4:16 am wrote:

Anders,

from an RP perspective this matter touches upon the statutory liability
level as for example it is addresse in art 6
of the EU Directive. The liability of the CA for publishing a certificate
featuring erroneous data, for example,
would be detrmined in court. The CA however, has the right to set a limit
to the value of the transactions a specific
cert can be used for. This does not mean that RPs cannot perform
transactions in excess to such cap, but only that
they act at their own risk.

A warranty --as I believe Alice said yesterday -- is a positive offer by
the CA to cover transactions up to a certain
limit. Such warranty, if accepted by RPs would limit any future claims,
with the exception of any statutory liability
the CA may incur. If there is a warranty and something goes wrong the RP
can have a direct claim from the CA. A
warranty makes sense since the potential risk for a CA is enormous, if you
consider the amount and value of the
transactions, a certificate can be used for. In support of a warranty the
CA might seek an insurance policy, but this
probably gets beyond the point.

On a certificate an RP possibly needs an indication of a cap -- this could
be just a numeric field. Warranty terms
can be part of the policy.

I hope this helps,

andreas

---

From: "Alice Sturgeon" <[email-masked]>
Date: Fri, 6 Dec 2002 12:15:00 -0500

Lynn, and others,
Looking at your last point first, if I were an insurer, I'd opt for the
aggregate model, being basically risk averse, to avoid getting slammed by
those one million ten-dollar transactions.  But this may be a matter of
knowing your community.  If that is the case, i.e., that the CA knows its
user community in terms of usage profile, then it might be comfortable in
offering per-transaction.  Thus both should be available.
On your two types of "warranties", I think you're using the wrong term for
your second type.
As I tried to categorize them earlier, liability really has nothing to do
with warranty.  In a dictionary sense, you might find a definition that
brings the two together, perhaps as analogous, but certainly in the legal
and insurance communities, they are very different indeed.
Your third paragraph offers a reason for having a warranty in a certificate.
If it is in the certificate, then the RP is not left out.

Alice

Alice Sturgeon
Chair
Canadian Advisory Committee - Information Technology Security
ISO/IEC JTC1 SC 27
and
System Policy Architect
SPYRUS
Phone:     613-232-2350
Cell:         613-291-0331

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: December 6, 2002 8:47 AM
To: Andreas Mitrakas
Cc: Anders Rundgren; [email-masked]; Denis Pinkas; Russ Housley;
[email-masked]
Subject: Re: draft-ietf-pkix-warranty-extn-01.txt

Anders,

I hope this helps,

andreas