$90 for high assurance _versus_ $349 for low assurance

[Ian G]

In the below, John posted a handy dandy table of cert prices, and
Nelson postulated that we need to separate high assurance from low
assurance.  Leaving aside the technical question of how the user
gets to see that for now, note how godaddy charges $90 for their
high assurance and Verisign charges $349 for their low assurance.

Does anyone have a view on what "low" and "high" means in this
context?  Indeed, what does "assurance" mean?

iang


John Gilmore wrote:
> For the privilege of being able to communicate securely using SSL and a
> popular web browser, you can pay anything from $10 to $1500.  Clif
> Cox researched cert prices from various vendors:
> 
>   http://neo.opn.org/~clif/SSL_CA_Notes.html

Nelson B wrote:
 > https://www.godaddy.com/gdshop/ssl/ssl.asp shows that this CA runs
 > two classes, high assurance and low assurance.
 >
 > Do they have two roots that correspond to these two classes?
 > If not, how can users choose to trust high assurance separately
 > from (perhaps instead of) low assurance certs?
 >
 > I think mozilla's policy should require separate roots for separate
 > classes of assurance.  Alternatively, we could require separate
 > intermediate CAs for each class, issued from a common root, but
 > then the intermediates would have to be shipped with mozilla so
 > that they can be marked with explicit trust.

-- 
News and views on what matters in finance+crypto:
         http://financialcryptography.com/

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com