Draft. Cooperation Agreement

Transcription

1 Draft Cooperation Agreement between TeleTrusT ev. hereinafter referred to as TeleTrusT and hereinafter referred to as... C:\Dokumente und Einstellungen\dafi\Lokale Einstellungen\Temporary Internet Files\OLK1E\BridgeCaVertrag_e.doc

2 2 Preamble (1) TeleTrusT provides organizations with Bridge-CA : a low-cost and reliable service which enables the participating companies, authorities and institutions to check each other s certificates. As the bridge between the participants, Bridge-CA examines the root certificates of the participating organizations. The participant recognizes Bridge-CA as a trustworthy system. (2) The following objectives are of importance to the parties to the Contract: - Bridge-CA offers pragmatic solutions that are both platform- and manufacturerindependent. - It is based on workable standards that will stand the test of time, particularly in respect of interoperability. - It enables the sharing of experience in the development and operation of public key infrastructures (PKI). - It stipulates minimum requirements for participation in a certificate practice statement (CPS). - It provides information to companies and institutions that operate a PKI or intend to develop a PKI. - It promotes public key infrastructures within and between companies and public authorities, particularly in an international context. 1 Subject-matter of the Contract (1) TeleTrusT will provide the following services: - registration of the participating organizations - performance of compliance testing, - creation and provision of a Bridge CA certificate, - management and updating of a certificate database, - creation, provision and updating of a list of registered certificates, - publication of the sources of the security policy of the registered participants, - consultancy and training services in connection with Bridge-CA, - provision of information for operation and use of the system, - deregistration. 2 Checking applications (1) Applications are checked using a compliance test in accordance with the current test specification and the documents concerning security policy. (2) TeleTrusT can refuse registration if the compliance test reveals lack of compliance or if other important conditions for participation have not been met. 3 Operation of Bridge CA (1) The Bridge CA certificate is valid for four years. The certificates will be archived for a further 5 years after expiration of validity or revocation. (2) Four weeks before the authority of the private Bridge CA key to sign certificates expires, a new Bridge CA key pair and certificate will be generated. The information on the new certificate, including fingerprint, will be sent to the registered participants by conventional mail. The new Bridge CA certificate will be distributed to the registered participants by , or can be downloaded from the Bridge CA web server. (3) As soon as all the registered participants have been informed, a new signature certificate will be issued by Bridge CA and will be used from then onwards.

3 3 (4) Should the Bridge CA key be compromised or physically destroyed, the registered participants will be informed immediately by mail and . From then on, this key will no longer be used. (5) In the event of compromise, a new Bridge CA key pair and certificate plus a signed, new signature certificate will be generated. The information on the new certificate including fingerprint will be sent to the registered participants by conventional mail. The certificate will be distributed to the registered participants by , or can be downloaded from the Bridge CA web server. 4 Duties to cooperate (1) The parties to the Contract shall provide each other with the information and documentation required for the performance of the Contract. (2) The participant shall give an assurance that the information supplied is correct. (3) The registered participant undertakes to implement the security policy it has submitted. The requirements for such a policy are contained in the self-certification Annex A, which constitutes an integral part of this Contract. The annex will be amended in the event that any changes become necessary for technical or legal reasons. The period for amendment will be agreed between the parties to the Contract, but will be at least six months. (4) In the event that its root/ca certificates are revoked, the registered participant is obliged to deregister these certificates with Bridge CA without intentional or negligent delay. (5) The registered participant is obliged to verify the signature on the received signed list. This also includes checking the validity of the signature certificate using the Bridge CA certificate revocation list. Changes to the signature list must be evaluated and implemented locally within the PKI. Certificates that no longer appear on the list cannot be regarded as trustworthy. Certificates appearing on the list for the first time can be classed as trustworthy using the tools of the PKI concerned. (6) The registered participant must inform TeleTrusT immediately in the event of problems with the processing procedure or if it suspects fraud on the part of customers or staff, manipulation, breaches of security or data protection or other irregularities in connection with the operation of Bridge-CA. 5 - Confidentiality (1) The parties to the Contract undertake to keep confidential the information received directly or indirectly from the other party to the Contract, i.e. not to disclose it to any third party orally or in writing or by any other means. (2) Each partner will treat as confidential vis-à-vis third parties the information (e.g. storage media, drawings, documents, measurements, samples and all types of oral and written communication) disclosed to it by the other partner for the purposes of this agreement and only use such information for the purpose specified in this agreement (nondisclosure obligation with restriction on usage). (3) Third party within the meaning of these provisions does not include employees, other staff and advisers of the partners or employees of related companies of the partners who need this information to perform their duties in connection with the purpose of this agreement. The partners shall require their employees, other staff and advisers as well as the employees of related companies to give a non-disclosure undertaking, similar to that above, so far as such persons are not already under such an obligation. (4) The non-disclosure obligation with usage restriction does not extend to information which, at the time it is communicated, demonstrably - was already or subsequently becomes known, without any breach of the law,

4 4 - is quired by law to be published, - becomes known after receipt through no fault of the recipient partner, - is disclosed by a third party which is not subject to a duty of non-disclosure and non-use, provided that this third party has not received the information directly from the other party to the Contract, - is intended for promotional and publicity purposes of the parties to the Contract. (5) Each party to the Contract reserves all rights to the information supplied by it, including copyrights and the right to register marks, patents and utility models. (6) Joint projects may only be shown to third parties by prior agreement. (7) The non-disclosure duty with usage restriction applicable to both parties shall continue for a period of 5 years after the end of the cooperation agreement. 6 Data protection (1) TeleTrusT shall use the data obtained in connection with checks and controls strictly for the intended purpose i.e. only for the checks and controls provided for by law, and undertakes to maintain strict confidentiality. 7 Payment terms (1) The latest version of the price list for participant certification applies. (2) Training and consultancy services provided by TeleTrusT will be agreed separately. 8 Exclusion of warranty (1) TeleTrusT does not warrant the accuracy of the information supplied by the registered participants. Nor does it provide any warranty for the security policy of the registered participants, the functionality of the certificates or the permanent availability of the certificate revocation lists. 9 - Liability (1) Each party to the Contract shall be liable for loss - irrespective of the legal basis for such loss which is caused by a culpable breach of an essential condition of the Contract in a manner that could jeopardize the achievement of the purpose of the contract. The liability is limited to loss which is typical of the type of contract and which could have been foreseen by each party to the Contract at the time the Contract was concluded on the basis of the facts known to them at that time. (2) The parties to the Contract are not liable for lack of commercial success, lost profit, compensation for wasted expense pursuant to 284 BGB (German Civil Code) or compensation if the debtor is no longer liable to perform pursuant to 275 BGB. (3) Each party to the Contract is responsible for its own data security. The parties to the Contract are not liable for the restoration of data. (4) Damages are limited to 10,000. (5) The limitations on liability pursuant to (1) (4) also apply mutatis mutandis in favor of the employees and agents of the parties to the Contract. (6) Each party to the contract is obliged to notify the other party in writing immediately of damage and loss which it has incurred, or to allow the other party to establish the extent of such loss.

5 5 10 Contract term (1) The Contract may be terminated at any time by giving three months notice. (2) Amendments to the Contract, the requirements in the annex and the prices will be notified by TeleTrusT in writing or by . Should the party to the Contract disagree with an amendment, it may terminate the Contract within one month. (3) TeleTrusT may terminate the Contract without notice if a registered participant uses BridgeCA fraudulently, deliberately gives false information or fails to meet new requirements within the adjustment period Other (1) Varying or supplementary provisions, collateral agreements or amendments to these conditions as well as changes to the services to be provided shall be valid only if agreed in writing or by . (2) Should it become clear during the course of the work that the work cannot be carried out in the agreed form or if the intended result cannot be achieved or cannot be achieved by the agreed means, the parties to the agreement must notify the other of this in writing. Correct, but doesn t have to be written into the contract. (3) Should individual parts of the Contract concluded on the basis of these provisions be invalid, this shall not affect the validity of the Contract as a whole. The parties shall replace the invalid provisions with valid provisions that come as close as possible to achieving the intended purpose. The same shall apply in the event of a gap in the contract. (4) The rights and obligations arising from this Contract may only be assigned to a third party with the prior written consent of the other party. (5) The courts of Bonn shall have jurisdiction over all disputes arising from this contract. (6) German law shall apply to all legal relations between TeleTrusT and the customer. (7) Annex A Self-certification revision date October 25, 2001 constitutes an integral part of this Contract. List of annexes: Annex A: Self-certification, revision date October 25, ,......,... Place, date Place, date TeleTrusT Deutschland e.v. Participants (company/organization)

6 6