Subject: Re: draft-ietf-pkix-warranty-extn-01

From: "Housley, Russ" <[email-masked]>
Date: Mon, 01 Jul 2002 13:19:17 -0400

Denis:

> > > > [REVISED TEXT:]  A relying party may obtain compensation from a CA 
> depending
> > > > on the conditions for such compensation expressed in either the CA's
> > > > Certificate Policy or the CA's insurance policy, or both.
> > >
> > >I believe that Russ said that the CA's insurance policy was included 
> in the
> > >CA's Certificate Policy. The "or" is not appropriate.
> >
> > That depends on the structure of the policy.  The CA might self-insure for
> > small claims, and have an insurance policy for larger ones.
>
>I disagree: what is important is what is visible for the relying parties.
>Self-insurance or back up insurance is a level of detail that is internal to
>the CA. This does not have to be visible to the relying party. The "or" is
>still not appropriate.

I think we are saying the same thing.  The CA might self-insure, get a 
policy from an insurance company, or a combination of the two.  This is of 
no interest to the relying party.  The replying party only cares that 
compensation is available.  If there is a problem, the relying party will 
contact the CA to make her claim.

Russ