Compriva Communications Privacy Solutions Inc. (Compriva Inc.)
Summary Certification Practice Statement ("CPS")
Compriva Inc.'s certification services
Compriva Inc.'s certification services relate to the Compriva™ Private Email certificate, an X.509 V3 compliant digital certificate, issued by the Compriva Certificate Authority (CA). Compriva Inc.'s public certification services are designed to provide secure electronic communication by leveraging the authentication and encryption features already present in supported email client software. Compriva Inc.'s Compriva Private Email certificate related public certification services are not intended to substantiate or authenticate the true identity of the individual associated with a digital certificate. Rather, they are designed to provide secure electronic communication among parties that have already established a level of trust between an email address and a true identity. Compriva Inc.'s certification services allow the Compriva Private Email registrant to digitally sign email to any other Compriva Private Email registrant, and to encrypt email to any Compriva Private Email registrant whose digital certificate the sender has accepted and stored in his/her address book. As well, registrants can invite correspondents to install a Compriva Private Email certificate or directly obtain their own Compriva Private Email certificate with which private, secure email communication can quickly be established with other trusted Compriva Private Email users.
Compriva Private Email CERTIFICATES ARE NOT INTENDED FOR COMMERCIAL OR ANY OTHER USE WHERE PROOF OF IDENTITY IS REQUIRED AND SHOULD NOT BE RELIED UPON FOR SUCH USES. Compriva Inc. HAS THE RIGHT, BUT NOT THE OBLIGATION, TO REVOKE Compriva Private Email CERTIFICATES UPON COMPROMISE OR FOR OTHER DUE CAUSE.
THE USE OF Compriva Private Email CERTIFICATES DOES NOT CONVEY EVIDENCE OF AUTHORITY ON THE PART OF ANY USER TO ACT ON BEHALF OF ANY OTHER PERSON. VERIFIERS OF DIGITALLY SIGNED MESSAGES ARE SOLEY RESPONSIBLE FOR EXERCISING DUE DILIGENCE AND REASONABLE JUDGEMENT BEFORE RELYING ON Compriva Private Email CERTIFICATES AND DIGITAL SIGNATURES.
Rights and obligations of applicants/registrants
(Users means registrants (paid or unpaid) and invited users. For self-registering users, the certificate applicant is also the certificate recipient.)
The user acknowledges that Compriva Inc. has provided him/her with sufficient information to become familiar with the usage and shortcomings of digital certificates and signatures before applying for/requesting, using and relying upon a certificate.
Users must independently assess and determine the appropriateness of Compriva Private Email certificate, and any other class of certificates.
All persons desiring a certificate shall contemporaneously complete the following general procedures for each certificate application:
- Accept a key pair generated by the Compriva Inc. CA or generate and provide to Compriva Inc. a key pair and demonstrate to Compriva Inc. that it is a functioning key pair;
- protect the private key (of this key pair) from compromise, the software system should provide this functionality;
- submit a certificate application (and certificate recipient agreement), including the public key of this key pair, to Compriva Inc.;
- not mislead Compriva Inc. as to the true identity of the intended certificate user.
The user must accept a certificate before communicating it to others, or otherwise inducing their use of it.
The user agrees to notify Compriva Inc. upon compromise of his/her private key.
By accepting a certificate issued by Compriva Inc., the certificate applicant and the certificate recipient certifies to and agrees with Compriva Inc. and to all who reasonably rely on the information contained in the certificate that at the time of acceptance and throughout the operational period of the certificate, until notified otherwise by the certificate applicant and certificate recipient:
- each digital signature created using the private key corresponding to the public key listed in the certificate is the digital signature of the certificate recipient and the certificate has been accepted and is operational (not expired, suspended or revoked) at the time the digital signature is created;
- no unauthorized person has ever had access to the certificate recipient's private key;
- all representations made by the person requesting the certificate to Compriva Inc. regarding the information contained in the certificate are true;
- all information contained in the certificate is true to the extent that the person requesting the certificate had knowledge or notice of such information and does not promptly notify Compriva Inc. of any material inaccuracies in such information. Upon retrieval from Compriva Inc., the recipient of the certificate shall verify that all information contained in the certificate is true to the extent that the person retrieving and accepting the certificate had knowledge or notice of such information and does not promptly notify Compriva Inc. of any material inaccuracies in such information;
- the certificate is being used exclusively for authorized and legal purposes;
- the certificate applicant and recipient will not use the private key corresponding to any public key listed in the certificate for purposes of signing any certificate (or any other format of certified public key) or CRL, as an Issuing Authority or otherwise, unless expressly agreed in writing between certificate applicant, recipient and Compriva Inc.
By accepting a certificate, the certificate recipient assumes a duty to retain control of his/her private key, to use a trustworthy system, and to take reasonable precautions to prevent its loss, disclosure, modification, or unauthorized use.
The user must revoke his/her certificate when there has been a loss, theft, modification, unauthorized disclosure, or other compromise of the private key of the certificate.
By requesting and receiving a certificate, the certificate applicant and recipient agree to indemnify and hold Compriva Inc. harmless from any acts or omissions resulting in liability, any loss or damage, and any suits and expenses of any kind that Compriva Inc. may incur, that are caused by the use or publication of a certificate and that arises from:
- Falsehood or misrepresentation of fact by the certificate applicant and/or recipient;
- Failure by the certificate applicant and/or recipient to disclose a material fact, if the misrepresentation or omission was made negligently or with intent to deceive Compriva Inc. or any person receiving or relying on the certificate;
- Failure to protect the certificate recipient's private key, to use a trustworthy system, or to otherwise take the precautions necessary to prevent the compromise;
- Loss, disclosure, modification or unauthorized use of the certificate recipient's private key.
Compriva Inc.'s rights and obligations
Compriva Inc. may generate the private key for a Compriva Private Email certificate registrant or invited user (as directed by a registrant in good standing with Compriva Inc.). This Private Key will be protected by a password known only to the registrant or (in the case of an invited user) the inviting registrant, and the Compriva Inc. CA. This copy of the Private Key will be destroyed from Compriva Inc.'s possession and records after successful retrieval by the intended recipient has been confirmed to Compriva Inc.'s satisfaction. In the event the Private Key is not retrieved by the intended recipient within ten days of its creation, it will be destroyed, and the corresponding digital certificate will be revoked by the Compriva Inc. CA.
A Compriva Private Email certificate certificate recipient may at any time request a replacement certificate from Compriva Inc., where generation of the Private Key occurs on the certificate recipient's computer. Also Compriva Inc. cannot ascertain or enforce any particular private key protection requirements of any certificate applicant or certificate recipient.
Upon receipt of a certificate application (registration or invited registration) Compriva Inc. shall perform all required validations as a prerequisite to certificate issuance, as follows:
Compriva Inc. shall confirm that:
- the certificate applicant and recipient are the people identified in the request (in accordance with and only to the extent provided in the certificate class descriptions). For self-registering users, the certificate applicant and recipient are the same person;
- the certificate recipient, upon successfully retrieving their Private Key and notifying Compriva Inc. as such, rightfully holds the private key corresponding to the public key to be listed in the certificate;
- the information to be listed in the certificate is accurate, except for non-verified certificate recipient information.
Once a certificate is issued, Compriva Inc. shall have no continuing duty to monitor and investigate the accuracy of the information in a certificate, unless Compriva Inc. is notified in accordance with that certificate's compromise.
Unless otherwise provided in the CPS or mutually agreed upon by Compriva Inc., the certificate applicant and the certificate recipient in an authenticated record, Compriva Inc. promises to the certificate recipient named in the certificate that:
- there are no misrepresentations of fact in the certificate known to Compriva Inc. or originating from Compriva Inc.;
- there are no data transcription errors as received by Compriva Inc. from the certificate applicant resulting from a failure of Compriva Inc. to exercise reasonable care in creating the certificate; and
- the certificate meets all material requirements of the CPS.
Unless otherwise provided in this CPS or mutually agreed upon by Compriva Inc., the certificate applicant and the certificate recipient in an authenticated record, Compriva Inc. promises to the certificate recipient to make reasonable efforts:
- to promptly revoke or suspend certificates upon valid request of the certificate applicant prior to validated retrieval by the certificate recipient and thereafter, the certificate recipient;
- to notify the certificate applicant and recipient of any facts known to it that materially affect the validity and reliability of the certificate it issued to such recipient.
Upon recipient's acceptance of the certificate, and checking by Compriva Inc., Compriva Inc. shall publish a copy of the certificate in the Compriva Inc. repository and in one or more other repositories, as determined by Compriva Inc. Recipients may publish their Compriva Inc. certificates in other repositories.
Compriva Inc. provides the controls and foundation for PKI, including Issuing Authority key generation, key protection, and secret sharing procedures. Compriva Inc. warrants that its own private keys are not compromised unless they provide notice to the contrary via the Compriva Inc. repository.
Use of certificates
The parties (Compriva Inc. and the parties who are "users" of the certificate, i.e., the certificate applicant, the certificate recipient and the relying parties), are hereby notified of the following rules governing the respective rights and obligations of the parties among themselves, which are also deemed to be agreed by the parties, effective:
- upon publication of the CPS in the case of Compriva Inc.;
- upon submission of an application for a certificate, in the case of an certificate applicant;
- upon confirmation to Compriva Inc. by the certificate recipient that they have successfully retrieved their digital certificate or;
- upon reliance of a certificate or a digital signature verifiable with reference to a public key listed in the certificate, in the case of a relying party.
Verification of Digital Signatures
Verification of a digital signature, is undertaken to determine that:
- the digital signature was created by the private key corresponding to the public key listed in the signer's certificate;
- that the associated message has not been altered since the digital signature was created.
Such verification shall be undertaken as follows:
- Checking the Compriva Inc.
(or other) repository for revocation or suspension of certificates
- The relying party must determine if any of the certificates along
the chain from the signer to an acceptable root has been revoked
or suspended, because a revocation or suspension has the effect of
prematurely terminating the operational period during which
verifiable digital signatures can be created. This may be
ascertained in two different ways. The Compriva Inc. repository may be
queried for the most up-to-date revocation status.
Alternatively, CRLs may have been provided in the certificate
chain. These CRLs may be used to determine the revocation
status of certificates in the chain.
- Delimiting data to which digital signatures are attached
In order to verify a digital signature it is necessary to know
precisely what data has been signed. In the case of public
key cryptography standards (PKCS), a standard signed message
format is specified to accurately denote the signed data.
- Indicating digital signature time and date of creation - In
order for a digital signature to support non-repudiation, the
data to which the corresponding digital signature is attached must
include, or reference, a time stamp. The time stamp
shall reflect the time at which date and time the digital
signature is affixed.
- Establishing the assurances intended by its signer - Various
technical means may be used to determine the purpose (or meaning)
of the digital signature intended by its signer. In formal
protocols (such as EDI), digital signatures are classified as
specified security services with defined semantics so as to convey
their precise meaning. The verifier should also determine
whether the certificate is normal or provisional.
- Ensuring that all certificates in the chain authorise use of an
end-user certificate holder private key - Compriva Inc. may limit the
purposes for which a private key corresponding to a certificate it
issues may be used. Such limitations are indicated or
incorporated by reference in the certificate and provide a means
to warn recipients of situations for which reliance upon the
certificate would not be considered reasonable. Persons
validating certificates must inspect certificate contents for
such warnings and limitations to ensure that no certificate in the
chain denies appropriate use of an end-user registrant
Effect of Validating an End-User Subscriber Certificate
A digital signature can be binding against its maker if it (i) was created during the operational period of a valid certificate, (ii) such digital signature can be properly verified by confirmation of certificate chain (iii) the relying party has no knowledge or notice of a breach of the requirements of the CPS by the signer, and (iv) the relying party has complied with all requirements of the CPS.
Procedures upon Failure of Digital Signature Verification
A person relying on an unverifiable digital signature assumes all risks with regard to it and is not entitled to any presumption that the digital signature is effective as the signature of the certificate holder.
Reliance on Digital Signatures
A recipient of a message signed by a digital signature of the certificate holder may rely upon that digital signature as binding against the registrant if:
- the digital signature was created during the operational period of a valid certificate and it can be verified by referencing a validated certificate chain, and
- such reliance is reasonable under the circumstances. If the circumstances indicate a need for additional assurances, the relying party must obtain such assurances for such reliance to be reasonable.
Additionally, the verifier should consider the class of certificate. The final decision concerning whether or not to rely on a verified digital signature is exclusively that of the verifier.
When admitted by law, a message bearing a digital signature verified by the public key listed in a valid certificate is as valid, effective, and enforceable as if the message had been written and signed on paper.
Where a rule of law or applicable practice requires a signature or provides for certain consequences in the absence of a signature, that rule can be satisfied in relation to a message by a digital signature affixed by a signer with the intention of signing a message and subsequently verified by reference to the public key listed in a valid certificate, if admitted by law.
Any person using or relying upon a Compriva Inc. certificate in conjunction with a message shall apply reasonable security measures to the message to provide message authentication and, as required, to support data confidentiality.
The Compriva Inc. Certificate Authority ("CA") Hierarchy
The Compriva Inc. CA hierarchy consists of one Root CA, which issues certificates to individual end users.
- The Compriva Inc. CA's duties are limited to approving the distinguished name of an end user certificate.
Standards and Protocols Used
The Compriva Inc. CA issues certificates in compliance with the X.509 specification. The certificate bearer's private key is expected to be an RSA key. Compriva Inc. anticipates supporting other such standards as market demands may warrant.
The Compriva Inc. CA provides the following services:
- Issuance of certificates
- Revocation of certificates
- Renewal and/or re-issuance of certificates
Compriva Private Email Certificate Properties
Confirmation of Identity
- Unambiguous SubjectName will be created by the Compriva Inc. CA. The Compriva Inc. Naming Authority may specify naming conventions which may vary with time and/or across classes of certificates.
- On-line completion of basic personal information by the person requesting the Compriva Private Email certificate
Certificate Holder Private Key Protection
- PIN/password protection recommended but not required
- Where a Compriva Private Email certificate is requested by a person different from the one the certificate will be issued to, the Compriva Inc. CA will generate a Private Key on behalf of the intended certificate recipient. This Private Key will be protected by a password known only to the person requesting the Compriva Private Email certificate, the desired recipient, and the Compriva Inc. CA. This copy of the Private Key will be destroyed after retrieval by the intended recipient. In the event the Private Key is not retrieved by the intended recipient within a pre-determined period of time days of its creation, it will be destroyed, and the corresponding digital certificate will be revoked by the Compriva Inc. CA.
Applications implemented or contemplated by Users
- Empowering private, secure Internet messaging.
Certificate Extensions and Enhanced Naming
The Compriva Inc. CA issues X.509 V3 compliant certificates. This CPS allows for additional private extensions for purposes specific to Compriva Inc. The function of each extension is indicated by a standard OBJECT IDENTIFIER value. Additionally, each extension in a certificate is assigned a "criticality" true/false value. The presence of a criticality value of true upon a specific extension requires all persons validating the certificate to consider the certificate invalid if they lack knowledge of the purposes and handling requirements for any specific extension with criticality value of true. If the criticality value of such extension is false, all persons shall process the extension in conformance with the applicable definition when performing validation or else ignore the extension.
Suspension and Revocation
A certificate shall be suspended or revoked if:
- there has been a loss, theft, modification, unauthorized disclosure, or other compromise of the private key of the certificate's subject;
- the certificate's subject (whether Compriva Inc. or a certificate applicant or recipient) has breached a material obligation under the CPS, or
- the performance of a person's obligations under the CPS is delayed or prevented by an act of God, natural disaster, computer or communications failure, or other cause beyond the person's reasonable control, and as a result another person's information is materially threatened or compromised.
Compriva Inc. must make a reasonable effort to suspend or revoke a certificate, if it determines any of the following:
- a material fact represented in the certificate is known or reasonably believed by Compriva Inc. to be false;
- a material prerequisite to certificate issuance was neither satisfied nor waived;
- the private key or trustworthy system was compromised in a manner materially affecting the certificate's reliability, or
- the certificate's subject has breached a material obligation under the CPS.
Compriva Inc. must revoke a certificate upon the certificate recipient's valid request once it has confirmed that the person requesting the revocation is in fact the certificate holder. The request must be done in the form of an authenticated record from the certificate holder or its agent or by means of a challenge phrase or recitation of certain pre-submitted enrolment information.
Upon suspending or revoking a certificate, Compriva Inc. must publish notice of the suspension or revocation in the Compriva Inc. repository.
During suspension, or permanently upon revocation of a certificate, that certificate's operational period shall immediately be considered terminated.
Suspension or revocation of a certificate shall not affect any underlying contractual obligations created or communicated under the CPS.
Private keys corresponding to public keys contained in suspended or revoked certificates shall be safeguarded by the certificate recipient in a trustworthy manner throughout the period of suspension and, upon revocation for the applicable retention period, unless destroyed.
Compriva Inc.'s Liability
- does not warrant the accuracy, authenticity, completeness or fitness of any unverified information contained in certificates or otherwise compiled, published, or disseminated by or on behalf of Compriva Inc.;
- does not warrant the accuracy, authenticity, completeness or fitness of any information contained in Compriva Private Email certificates;
- shall not incur liability for representations of information contained in a certificate, provided the certificate content substantially complies with the CPS;
- does not warrant "non-repudiation" of any certificate or message (because non-repudiation is determined exclusively by law and the applicable dispute resolution mechanism), and
- does not warrant any software.
In no event (except for fraud or willful misconduct) shall Compriva Inc. be liable for any indirect, incidental or consequential damages, or for any loss or profits, loss of data, or other indirect, consequential or punitive damages arising from or in connection with the use, delivery, license, performance or non performance of certificates, digital signatures, or any other transactions or services offered or contemplated by the CPS. Compriva Inc. will not be liable in this case if the fault in this verified information is due to fraud or willful misconduct of the applicant.
In no event (except for fraud or willful misconduct) will the liability of Compriva Inc. to all parties (including without limitation a certificate applicant, a certificate recipient, or a relying party) exceed the applicable liability cap for such certificate set forth in this table.
The liability of Compriva Inc. to any and all persons concerning a specific certificate shall be limited to an amount not to exceed the following, for the aggregate of all digital signatures and transactions related to such certificate:
Compriva Private Email certificate $0.00
Registrant and Certificate Holder's liability to relying parties
Without limiting other registrant and certificate holder obligations stated in the CPS, registrants and certificate holders are liable for any misrepresentations they make in certificates to third parties that, having verified one or more digital signatures with the certificate, reasonably rely on the representations contained therein.
No fiduciary relationship
The relationship between Compriva Inc., certificate applicants and recipients and that between Compriva Inc. and relying parties is not that of agent and principal. Neither certificate applicants nor certificate recipients nor relying parties have any authority to bind Compriva Inc., by contract or otherwise, to any obligation. Compriva Inc. shall make no representations to the contrary, either expressly, implicitly, by appearance, or otherwise.
Compriva Inc.'s public certification services are not designed, intended, or authorized for use or resale as control equipment in hazardous circumstances or for uses requiring fail-safe performance such as the operation of nuclear facilities, aircraft navigation or communication systems, air traffic control systems, or weapons control systems, where failure could lead directly to death, personal injury, or severe environmental damage.
Infringement and Other Damaging Material
Certificate applicants, either for one's self or on behalf of another (invited) person, (and, upon acceptance, certificate recipients) represent and warrant that their submission (to Compriva Inc.) and use of a domain and distinguished name (and all other certificate application information) does not interfere with or infringe upon the rights of any third parties in any jurisdiction with respect to their trademarks, service marks, trade names, company names, or any other intellectual property right, and that they are not seeking to use the domain and distinguished names for any unlawful purpose, including, without limitation, tortuous interference with contract or prospective business advantage, unfair competition, injuring the reputation of another, and confusing or misleading a person, whether natural or incorporated. Certificate applicants, either for one's self or on behalf of another (invited) person (and, upon acceptance, certificate recipients) shall defend, indemnify, and hold Compriva Inc. harmless for any loss or damage resulting from any such interference or infringement.
Compriva Inc. shall not be responsible for non-verified certificate applicant and recipient information submitted to Compriva Inc., or the Compriva Inc. repository or otherwise submitted for inclusion in a certificate. In particular, applicants and certificate recipients shall be solely responsible for the legality of the information they present for use in certificates issued under this CPS, in any jurisdiction in which such content may be used or viewed. Because laws regarding the transmission and availability of information content are constantly changing and vary widely, certificate applicants' and recipients' responsibilities are determined not only by laws in existence at the time Compriva Inc. issues a certificate to a person but also by any laws that may be enacted after such date. Certificate applicants and certificate recipients should be aware that there are many laws regarding the transmission of data, especially data that is encrypted or involves encryption algorithms, and that these laws may vary dramatically from country to country. Further, it is generally not possible to limit the distribution of content on the Internet or certain other networks based on the locality of the user/viewer, and this may require certificate applicants and certificate recipients to comply with the laws of each jurisdiction in which the content may be viewed or used.
Certificate applicants and certificate recipients will not submit to Compriva Inc., or the Compriva Inc. repository any materials that contain statements that (i) are libelous, defamatory, obscene, pornographic, abusive, bigoted, hateful, or racially offensive, (ii) advocate illegal activity or discuss illegal activities with the intent to commit them, or (iii) otherwise violate any law.
Compriva Inc. may charge users fees for their use of Compriva Inc.'s services. A current schedule of such fees is available from the Compriva Inc. repository at http://www.compriva.com/products. Such fees are subject to change seven (7) days following their posting in the Compriva Inc. repository.
Choice of Cryptographic Methods
All persons acknowledge that they are solely responsible for and have exercised independent judgment in choosing security software, hardware, and encryption/digital signature algorithms, including their respective parameters, procedures, and techniques.