<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoPlainText>Of course by saying that “<b><i>Again this means, for instance, a bigger CA which has 100.000 active OV SSLs in the market will need to be liable for 500 million USD</i></b>.”, I do not mean misissuing this much SSL.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>What I’m interpreting from Kirk’s ballot is, for this much active (and healthy) SSL in usage, I somehow need to guarantee the 5000 USD per SSL financial liability which totals 500.000 USD, just in case. <o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>So, there should be a clear interpretation of the ballot statement “<b><i>CAs must retain minimum potential liability for DV certs of at least $2,000, for OV certs $5,000, and for EV certs $10,000</i></b>.”. <o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><b><u>Question</u></b><b>: </b>What exactly does a CA having 100.000 active OV SSLs “must retain” as a financial requirement according to this ballot?<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>-----Original Message-----<br>From: Gervase Markham [mailto:gerv@mozilla.org] <br>Sent: 11 Aralık 2014 Perşembe 17:42<br>To: N. Atilla Biler; kirk_hall@trendmicro.com; 'CABFPub'<br>Subject: Re: [cabfpub] Reasons in support of Ballot 141</p><p class=MsoPlainText><span lang=TR><o:p> </o:p></span></p><p class=MsoPlainText><span lang=TR>On 11/12/14 10:11, N. Atilla Biler wrote:<o:p></o:p></span></p><p class=MsoPlainText><span lang=TR>> If a CA has 1000 OV certs issued to 1000 different clients, does this <o:p></o:p></span></p><p class=MsoPlainText><span lang=TR>> statement imply, for instance, that<o:p></o:p></span></p><p class=MsoPlainText><span lang=TR>> <o:p></o:p></span></p><p class=MsoPlainText><span lang=TR>> · the CA should put aside some liquid assets that would sum up<o:p></o:p></span></p><p class=MsoPlainText><span lang=TR>> to 5 million USD for their liability? or alternatively<o:p></o:p></span></p><p class=MsoPlainText><span lang=TR>> <o:p></o:p></span></p><p class=MsoPlainText><span lang=TR>> · the CA should have an insurance of 5 million USD for their<o:p></o:p></span></p><p class=MsoPlainText><span lang=TR>> liability?<o:p></o:p></span></p><p class=MsoPlainText><span lang=TR><o:p> </o:p></span></p><p class=MsoPlainText><span lang=TR>Neither, necessarily (as I read it). The insurance is per Relying Party, and it's not easy to count those.<o:p></o:p></span></p><p class=MsoPlainText><span lang=TR><o:p> </o:p></span></p><p class=MsoPlainText><span lang=TR>The point is that if a CA misissues a DV cert and 1,000 people rely on it and get scammed, then the CA's potential liability is $2M, if all of those people successfully sue the CA (perhaps as part of a class action suit). If 100,000 people _all_ get scammed, the potential liability is higher. But the chances of this happening are also extremely slim.<o:p></o:p></span></p><p class=MsoPlainText><span lang=TR><o:p> </o:p></span></p><p class=MsoPlainText><span lang=TR>> In any case, the cost of this liability to that CA will be more than <o:p></o:p></span></p><p class=MsoPlainText><span lang=TR>> “one penny” if the above understanding is true.<o:p></o:p></span></p><p class=MsoPlainText><span lang=TR><o:p> </o:p></span></p><p class=MsoPlainText><span lang=TR>I believe what Kirk means is that there is no necessary additional cost<o:p></o:p></span></p><p class=MsoPlainText><span lang=TR>- the CA may choose to assume the risk of misissuance. If a CA wishes, in the light of the new requirement, to insure against its own malpractice, then perhaps there would be a cost for that insurance.<o:p></o:p></span></p><p class=MsoPlainText><span lang=TR><o:p> </o:p></span></p><p class=MsoPlainText><span lang=TR>> Again this means, for<o:p></o:p></span></p><p class=MsoPlainText><span lang=TR>> instance, a bigger CA which has 100.000 active OV SSLs in the market <o:p></o:p></span></p><p class=MsoPlainText><span lang=TR>> will need to be liable for 500 million USD. If we even consider the <o:p></o:p></span></p><p class=MsoPlainText><span lang=TR>> relying parties for this CA, say 1 million end users as a minimum, the <o:p></o:p></span></p><p class=MsoPlainText><span lang=TR>> liability amount will be 5 billion USDs where the things become ridiculous.<o:p></o:p></span></p><p class=MsoPlainText><span lang=TR><o:p> </o:p></span></p><p class=MsoPlainText><span lang=TR>If a CA has misissued 100,000 certs, then perhaps it's better if it goes out of business! ;-))<o:p></o:p></span></p><p class=MsoPlainText><span lang=TR><o:p> </o:p></span></p><p class=MsoPlainText><span lang=TR>Gerv<o:p></o:p></span></p></div></body></html>