Subject: CA Liability:Warranty/ draft-ietf-pkix-warranty-extn-01.txt

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 16 Jan 2003 08:06:52 +0100

Hi PKI-lawyers,

I took the liberty to check how VeriSign handles this and
it was sort of enlightening (well...)

http://www.verisign.com/netsure ?

They talk about "limited liability warranty" (!!!) which sort of verifies
that what we call this is all over the map but the consequences
are the same as when your house is burning down:  If insured, you 
file a damage report and depending on the cause and nature of the
damage you may get something between zero to full compensation
up to a certain limit.

Q: A typical US SW agreement contains paragraphs that seems to
be intended to LIMIT liability as it states that you use it on your
own risk, and not for mission-critical stuff.  If this really works (it
does?) for software, why would it not work for CAs?

IF it *IS* possible (this ought to be investigated) to limit liability
by an agreement, this should be a part of the extension as there is
a demand for such measures.

Cheers,
Anders Rundgren
Senior Internet e-Commerce Architect

---

From: Roger Younglove <[email-masked]>
Date: Thu, 16 Jan 2003 09:05:30 -0500

Anders,
In the development of a large PKI we wrote a limited liability clause in the
CP and also in the RP agreement, legally this met the requirements of the CA
operator.

Roger Younglove, CISSP
Principal Consultant
NetWorks Group
O. 810.225.4800 ex. 2245
M. 810.599.0879
E. [email-masked]
www.networksgroup.com

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]] 
Sent: Thursday, January 16, 2003 2:07 AM
To: [email-masked]
Subject: CA Liability:Warranty/ draft-ietf-pkix-warranty-extn-01.txt

Hi PKI-lawyers,

Cheers,
Anders Rundgren