Subject: Re: draft-ietf-pkix-warranty-ext-01

From: [email-masked]
Date: Mon, 2 Sep 2002 13:38:54 -0600

In addtion to insurance premiums proportional to risk
http://www.garlic.com/~lynn/aadsm12.htm#20" draft-ietf-pkix-warranty-ext-01
There are actually a couple of issues:

a) security/insurance proportional to risk. in the online world ... the
RP/merchant may get a surcharge per transaction that pays for insurance on
per transaction basis. they may also have one-time disaster insurance ...
that is sort of independent of the number of transactions ... but
represents some total value that is at risk

b)  the entity at risk pays for the insurance. typically the business
arrangement is between the CA and the entity being certified. if it is a
merchant certificate then the CA can charge a little bit more for the
insurance to cover damages where the merchant might get sued. if it is a
consumer certificate .... the consumer is being charge but typically the
merchant is still the one at risk; not the consumer (this is because there
are special provisions favoring consumers in retail transactions .... this
wouldn't apply between two equal parties in commercial transactions).
Ignoring for a moment the issue of whether (offline paradigm) certificates
are needed in the online world, there is a separate issue that the entity
primarily at risk is not party to the CA/consumer business transaction.
There is nominally no direct business relationship between the CA & the
merchant in the case of consumer certificates .... so it is difficult for a
merchant to establish liability (possibility other civil legal issues)
against the CA.  Difficult for a merchant to sue a consumer because of CA
liability to the consumer.

CAs either have to

1) convince consumers that certificates are good for something that
consumers have at risk (say identity theft) for which the CA can justify
charging the consumer extra to cover the cost of doing business as well as
ancillary things like  insurance  ... or

2) CAs have to revamp the business model so that there is a contractual
relationship between the CA and the RP ... and be able to charge on the
basis of that   ... or

3) get gov. to pass mandated certificate requirements.

now ... if

1) if consumers (or any party) aren't at risk ... it is hard to get them to
(directly) pay anything

2) if a contractual relationship between CAs and RPs can be fabricated ....
then you are likely to have relying-party-only certificates .... the RPs
pay either directly or indirectly (so that there is a contractual
relationship with the CA on which money flow can be based) ...  the RPs
will pass on the cost for relying-party-only certificates to the consumer
.... but it is a business solution to match the money flow with who is at
risk and the contractual relationships. The downside here is that it is
trivially possible to show that relying-party-only certificates in an
online, transaction world are redundant and superfluous. This establishes
some basis for civil litigation.

3) if you can get a gov. to pass bills mandating something ... then you can
eliminate any civil liability issues with the contractual relationships and
money flow not matching parties at risk.

I believe there has been lots of past discussions regarding the difficulty
in the commercial world of establish money flow & risk with the RP in a
standard CADS paradigm (the RP being at risk but original CADS business
model had no contractual relationship between the CA and the RP). I believe
the FED GSA PKI stuff has tried to resolve this by contorting the business
model that the contractual relationship is between GSA and the CAs .... and
that the CAs are providing (relying-party) certificates to end-users. CAs
may levy a surcharge on the end-users for the certificate issuing ... but
the business relationship is not between the CA and the end-user .... it is
between the CA and GSA (the relying party). Note that since the business
relationship is between the CA and the GSA, the contract(s) call out the
warranties and liabilities.  In this case, certificates would be considered
a service provided and independent of the contract documents and the
specifications of T&Cs, warranties, liabilities and things like insurance.

The next step would be to get some kind of legislative bill passed that
mandates such certificates .... even when it can be proven that they are
redundant and superfluous in an online world.

random refs on relying party certificates:
http://www.garlic.com/~lynn/subtopic.html#rpo

[email-masked] wrote:

Alice,

I concur with many of the arguments raised by Anders. It is very scarce,
but
this time it happened, thanks to your draft. :-)

I believe that sufficient arguments have been raised against the
progression
of this draft, as it stands, which does not even explicitly states, for a
naive reader, what the warranty is about.

The warranty is concerned with the liability of the CA, more precisely,
only
errors made by the CA personal or attributed to the CA during the
management
of the certificate, e.g. at the time of registration of the subject, when
issuing the certificate, when handling revocation requests or when making
available revocation status information.

Regards,

Denis