<p dir="ltr">Hi Kirk,</p>
<p dir="ltr">I don't see how this addresses the root concern, which is establishing liability.</p>
<p dir="ltr">You focus on disclaiming liability for valid claims, but you fail to identify what is a valid claim. This is hidden in the "legally recognized and provable claims" language that retains its (effectively unworkable) ambiguity.</p>
<p dir="ltr">For example, many CP/CPS disclaim liability if the RP application did not perform (CRL, OCSP) checking in hard fail mode. CAs hopefully realize why this would be unacceptable for browsers to deploy, and indeed none do, but it has the effect of eliminating the CA's obligations of liability due to the fact that the client failed to meet the CA's definition of liability.</p>
<p dir="ltr">Likewise, most CP/CPSes restrict liability to financial transactions. As I discussed in great detail previously, on our calls and via email, this allows a CA to disclaim liability if user's password is compromised due to a misissuance, and that compromised password used on some secondary site to perform a financial transaction. This indirection through a secondary site allows CAs to argue the liability is on the secondary site for not having stronger password controls, such as mandatory rotation or two factor auth.</p>
<p dir="ltr">As such, while I greatly appreciate your efforts to continue to explore this, it still falls short of addressing the many concerns with the liability provisions in general, and the "actual security" provided by this is equivalent to the security provided by OCSP in soft fail - that is, no value at all, except from the most ignorant of (attacker, CA). Which is not much at all.</p>
<div class="gmail_quote">On Nov 26, 2014 12:14 AM, "<a href="mailto:kirk_hall@trendmicro.com">kirk_hall@trendmicro.com</a>" <<a href="mailto:kirk_hall@trendmicro.com">kirk_hall@trendmicro.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal">Here is the pre-ballot I have been working on for several weeks to replace the existing EV insurance requirements with new financial responsibility provisions. (Gerv, I just noticed you also have a pre-ballot – please take a look at this
one as well.)<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">As you know, Trend Micro was the first to suggest the existing EVGL insurance requirements didn’t make much sense in terms of making sure CAs were financially responsible for their product (certificates) and making sure CAs were financially
capable of dealing with certificate mis-issuance, a breach, and/or possible termination expenses.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">In recent emails, I suggested two possible substitutes for mandatory CA insurance:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-left:.5in">1. Minimum capital requirements (similar to the measurements we already have at the end of current EVGL Sec. 8.4 on insurance) – I’m still working on that proposal, and will come back with something shortly.<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-left:.5in">2. Making CAs potentially liable for certificate mis-issuance for all their certs – DV, OV, and EV – not just for EV certs. This proposal is very simple, and is included in the attached pre-ballot.<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
<p class="MsoNormal">Today, CAs can disclaim (deny) their legal liability for DV and OV certs all the way to zero – meaning, even if they are found liable by a court for damages to customers and relying parties for mis-issued certificates, they can avoid making
any payments to anyone. That’s just plain wrong. The EV Guidelines presently allow CAs to limit what they pay to customers and relying parties for mis-issued certificates to $2,000 – that’s too low, considering all the potential risks to the public.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The attached pre-ballot simply raises the potential liability cap to $10,000 for mis-issued EV certs, and requires that CAs potentially be liable up to $5,000 for mis-issued OV certs and $2,000 for mis-issued DV certs. This recognizes
the different levels of verification that are applied to each type of cert.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u>Please note</u>: This ballot does <u>not</u> create or impose legal liability on any CA – that already exists under applicable national law. What the ballot does is say that a CA must be willing to back up whatever legal liability
it has by some amount of money, and can’t just say to customers and relying parties who have valid legal claims for damages “Too bad, I’m not going to pay you anything.” We do, however, allow CAs to cap their liability at the $2,000 / $5,000 / $10,000 per
cert levels, which would help keep aggregate damage claims within an overall limit.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We have done so many other things to avoid and detect certificate mis-issuance (e.g., the Network and Certificate Systems Security Requirements, Certificate Transparency, etc.) that this is a natural extension of that effort – and it will
reinforce the value of SSL certificates from trusted CAs.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Several CAs I’ve consulted with already support these three liability levels. I’d be happy for endorsers for this pre-ballot.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b><i><span style="font-size:14.0pt;font-family:"Bradley Hand ITC";color:#0f243e">Kirk R. Hall<u></u><u></u></span></i></b></p>
<p class="MsoNormal">Operations Director, Trust Services<u></u><u></u></p>
<p class="MsoNormal">Trend Micro<u></u><u></u></p>
<p class="MsoNormal"><a href="tel:%2B1.503.753.3088" value="+15037533088" target="_blank">+1.503.753.3088</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">*****<u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-family:"Arial","sans-serif""><u></u> <u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-family:"Arial","sans-serif"">Pre-Ballot on Insurance and Financial Responsibility<u></u><u></u></span></b></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif"">1. EV Guideline 8.4 is deleted.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif"">2. EV Guideline Section 18 is amended to read as follows:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><b><span style="font-family:"Arial","sans-serif"">18. Liability and Indemnification<u></u><u></u></span></b></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-family:"Arial","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-family:"Arial","sans-serif"">CAs MAY limit their liability as described in Section 18 of the Baseline Requirements except that a CA MAY NOT limit its liability to Subscribers
or Relying Parties for legally recognized and provable claims to a monetary amount less than
<s>two</s> <b><u>ten</u></b> thousand US dollars per Subscriber or Relying Party per EV Certificate.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-family:"Arial","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-family:"Arial","sans-serif"">A CA's indemnification obligations and a Root CA’s obligations with respect to subordinate CAs are set forth in the Baseline Requirements.<u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Arial","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Arial","sans-serif"">3. Baseline Requirements Section 18.1 is amended to read as follows:<u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Arial","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-family:"Arial","sans-serif"">18.1 Liability to Subscribers and Relying Parties
<u></u><u></u></span></b></p>
<p class="MsoNormal" style="text-autospace:none"><b><i><span style="font-family:"Arial","sans-serif""><u></u> <u></u></span></i></b></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Arial","sans-serif"">If the CA has issued and managed the Certificate in compliance with these Requirements and its Certificate Policy and/or Certification Practice Statement, the CA
MAY disclaim liability to the Certificate Beneficiaries or any other third parties for any losses suffered as a result of use or reliance on such Certificate beyond those specified in the CA's Certificate Policy and/or Certification Practice Statement. If
the CA has not issued or managed the Certificate in compliance with these Requirements and its Certificate Policy and/or Certification Practice Statement, the CA MAY seek to limit its liability to the Subscriber and to Relying Parties, regardless of the cause
of action or legal theory involved, for any and all claims, losses or damages suffered as a result of the use or reliance on such Certificate by any appropriate means that the CA desires. If the CA chooses to limit its liability for Certificates that are not
issued or managed in compliance with these Requirements or its Certificate Policy and/or Certification Practice Statement, then the CA SHALL include the limitations on liability in the CA’s Certificate Policy and/or Certification Practice Statement.
<b><u>Notwithstanding the foregoing, a CA MAY NOT limit its liability to Subscribers or Relying Parties for legally recognized and provable claims to a monetary amount less than two thousand US dollars per Subscriber or Relying Party per DV Certificate or less
than five thousand US dollars per Subscriber or Relying Party per OV Certificate</u></b>.<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<table><tr><td bgcolor="#ffffff"><font color="#000000"><pre><table><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table></pre></font></td></tr></table>
<br>_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><br>
<br></blockquote></div>