A question of trust

Abstract

Despite nearly a decade of intensive effort by the computer science and legal communities, establishing interoperation of trust services remains one of the key challenges for e-commerce. Many early commentators had high hopes that the advent of Public Key Infrastructure (PKI) would provide the basis for securing electronic transactions and establishing trust. It is now increasingly evident that such early aspirations were overly optimistic and the adoption of PKI has in fact been more limited. There are differing accounts of the sluggish PKI take-up in the market, each focusing on particular issues in PKI, for example security and risk [6], interoperability [9], privacy concerns over identity-based certificates [5], and legal obstacles [11].While much progress has been made through collaborations between technical and legal experts [7], other information security researchers have begun to turn to economics for further insight into information security [4] and risk management [8]. This article argues, from an economic perspective, that one of the factors contributing to the hesitancy in adopting commercial trusted third-party services pertains to quality uncertainty in the certification services market. We explain the problem of quality uncertainty as resulting from the asymmetry of information between buyers and sellers, and illustrate the existence of such a problem in the certification services market. Further, we review existing implementations of standards as signaling devices for reducing quality uncertainty in the trust services market. Finally, we reflect on the current situation and consider the role of standards in enhancing market effectiveness.