Subject: [pkix] License fee for running a PKI

From: "Erik Andersen" <[email-masked]>
Date: Mon, 30 Apr 2012 17:36:22 +0200

Hi Folks,

I have received questions for which I need help to answer. The question is
as follows 

- Is that any government requires payment of fees by electronic signature
service providers

- If this is the case, what is the frequency of payment and above what is
the amount

I believe that the first question is: Are there examples where a PKI service
provider needs to pay a license fee to the government?

Any help is highly appreciated.

Erik

---

From: Martin Rex <[email-masked]>
Date: Mon, 30 Apr 2012 17:58:37 +0200 (MEST)

> provider needs to pay a license fee to the government?

I doubt that countries sell "license for running  electronic signature
services" similar to how they sell licenses for radio frequencies.

But the cost incurred (audits,accreditation) to create "trustworthy"
electronic signatures might be non-marginal, e.g. such as for issuing
certs that permit creation of "qualified signatures" in the EU:

http://europa.eu/legislation_summaries/information_society/other_policies/l24118_en.htm

-Martin

---

From: "Moudrick M. Dadashov" <[email-masked]>
Date: Mon, 30 Apr 2012 20:52:52 +0300

Directive 1999/93/EC:

in order to stimulate the Community-wide provision of certification 
services over open networks, certification-service-providers should be 
free to provide their services without prior authorisation; prior 
authorisation means not only any permission whereby the 
certification-service-provider concerned has to obtain a decision by 
national authorities before being allowed to provide its certification 
services, but also any other measures having the same effect;

Thanks,
M.D.

On 4/30/2012 6:58 PM, Martin Rex wrote:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: Martin Rex <[email-masked]>
Date: Mon, 30 Apr 2012 20:03:42 +0200 (MEST)

> services, but also any other measures having the same effect;

In practice, the legal requirements (at least in Germany) for most
regulated usage scenarios require the use of a "qualified signature"
or a specific trust center (e.g. Elster, GKVNet).

-Martin

---

From: "Moudrick M. Dadashov" <[email-masked]>
Date: Tue, 01 May 2012 02:13:19 +0300

Do those "trust centers" need a formal registration/approval by local 
authorities?

Thanks,
M.D.

---

From: Martin Rex <[email-masked]>
Date: Tue, 1 May 2012 01:50:25 +2600 (MEST)

> Do those "trust centers" need a formal registration/approval by local 

No.  But that that question does not fit here.

The organizations or authorities that have been tasked (by applicable laws)
to provide secure electronic data transmissions have defined the data formats,
and set up a trust center that will issue certificates matching their
requirements with respect to (a) consistently identifying entities
participating in the data exchange and (b) ensure a consistent level
of "authentication" before issuing PKI credentials.

It's no so much different from various different organizations issuing
plastic "membership" cards that populates everyone's wallet these days.

-Martin

---

From: Stephen Wilson <[email-masked]>
Date: Tue, 01 May 2012 15:19:47 +1000

Yes, in Europe, for all parties to fully enjoy the protections of 
qualified e-signatures laws, the CAs have to be accredited under a 
recognised scheme like "tScheme".

I thought the same thing applied in the very first digital signatures 
regime in Utah?  I thought CAs there had to be licensed, and part of 
that was audit by a recognised accounting firm?

A similar scheme technically applies in Hong Kong where the CA 
Recognition Authority is supposed to accredit CAs under the 
E-Tansactions Ordinance.  I say "technically" because participation in 
CARO and all similay systems even in Europe is weak.  There are costs 
involved and the cost-benefit remains uncertain while usage of 
certificates in open commerce remains low.  On the other hand, use of 
certificates in closed commerce is healthy but does not require 
independent homolugation because specific contracts apply.

If there is cause for government endorsement of digital certificates, 
then it follows that a conformance assessment regime is necessary, and 
there would generally be costs associated with participating.  Costs of 
doing business, just like the need for banks, medical establishments, 
airplane manufacturers and so on to be audited under all sorts of rules.

Cheers,

Steve Wilson
Lockstep
http://lockstep.com.au