Reliance Management and Trust Brokering
Current CA model has limited value
CA issues (issuer) a certificate to a subscriber
Subscriber presents certificate as an assurance of identity (and other stuff) to a relying party
Problem is:
- issuer is not in the loop on the subscriber/relying party transaction
- unbounded risk, therefore will not provide liability
- relying party unlikely to rely on certificates (for high value) without backing or warranty
- subscribers unlikely to buy certificates that have no value
Fractured TTP market
- Low assurance identity certificates
- High assurance reliance certificates with warranty
- No such thing as trust……it’s risk management for a fee