Subject: [pkix] Contractual privity in OIX and NS-TIC

From: Stephen Wilson <[email-masked]>
Date: Mon, 13 Sep 2010 04:24:52 +1000

I am sure that many on the PKIX list will recall the problem of 
"contractual privity" from the the early days of PKI.  With no contract 
between a CA and a Relying Party, it is hard to manage legal risks when 
the CA has no control over how a Subject is going to use their certificate.

One popular legal tactic was to try to create some sort of privity, by 
asking RPs to sign up to a Relying Party Agreement.  I remember when 
working on the beTRUSTed CA being advised circa 2000 that the RP 
Agreement gave us no guarantee but was "better than nothing".

A careful study by reputable e-commerce lawyers commissioned by the 
Australian Government in 2000 concluded "It is very uncertain how 
Australian law will apply to the relationship and allocation of risk 
between CAs and RPs" [Ref: "Legal liability and e-transactions" 
http://unpan1.un.org/intradoc/groups/public/documents/apcity/unpan014676.pdf. 

Two questions:

1. Do any lawyers on the list know of developments in respect of 
contractual privity that have since clarified the allocation of risk 
between CAs and Relying Paries?

2. Why wouldn't the same uncertainties apply to IDPs in the Open 
Identity Exchange and the ecosystem envisaged by the National Strategy 
for Trust Identities in Cyberspace (NS-TIC)?

Cheers,

Steve Wilson
Lockstep
www.lockstep.com.au.