<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>
<div>On Dec 5, 2012, at 5:18 PM, Owen DeLong <<a href="mailto:owen@delong.com">owen@delong.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>
<div>On Dec 5, 2012, at 13:18 , John Curran <<a href="mailto:jcurran@arin.net">jcurran@arin.net</a>> wrote:</div>
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>
<div>Wes - </div>
<div><br>
</div>
<div> We've done extensively legal work, but outlining the circumstances of </div>
<div> potential liability publicly is not something that makes sense for ARIN </div>
<div> to do. If you obtain commercial certificates (e.g. SSL), you will generally</div>
<div> find that you enter into agreements that require you provide indemnification </div>
<div> to the provider based on your use of the certificate.</div>
</div>
</div>
</blockquote>
<div><br>
</div>
But the purchaser (web site) is rarely the relying party (visitor to web site).</div>
</div>
</blockquote>
<div><br>
</div>
Correct. In the case of an SSL certificate, the organization obtaining it is generally </div>
<div>the harmed party if something goes wrong or they misuse it (e.g. Internet users can't </div>
<div>get to their application, or receive an interesting warning,etc.) While the relying party</div>
<div>is technically the end-user and his browser, the consequences for any one user is </div>
<div>really quite low. The user may not indemnify the certificate provider as a result, but </div>
<div>the organization obtaining the certificate does.</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div><br>
</div>
</div>
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>With ARIN RPKI, you've seriously expanded and effectively reversed the</div>
<div>nature of the contractual relationship in the creation of the RPA. You're</div>
<div>not only requiring those receiving certificates to sign, you're requiring</div>
<div>those obtaining certificate data to sign.</div>
</div>
</blockquote>
<br>
</div>
<div>Those validating certificates are "relying parties", and yes, we require them to</div>
<div>have a "relying party agreement." Note that in this case, the relying party is</div>
<div>likely to be an entire organization or service provider, as opposed to a single</div>
<div>user, and the consequences of incorrect usage could be quite extensive and </div>
<div>impacting many parties who are downstream of the relying party. The scale</div>
<div>and potential for consequences to entire organizations otherwise unaware of</div>
<div>the use the technology more than warrants seeking indemnification from relying</div>
<div>parties, just as organizations using certificates for the web sites provide it their</div>
<div>service providers,</div>
<div><br>
</div>
<div>FYI,</div>
<div>/John</div>
<div><br>
</div>
<div>John Curran</div>
<div>President and CEO</div>
<div>ARIN</div>
<div><br>
</div>
<br>
</body>
</html>