EXHIBIT 10.16 OEM Master License Agreement Number: ______________________________ Date of Agreement: April 18, 1995 BSAFE/TIPEM OEM MASTER LICENSE AGREEMENT THIS OEM MASTER LICENSE AGREEMENT ("Agreement") is entered into on the date set forth above between RSA Data Security, Inc., a Delaware corporation ("RSA"), having a principal mailing address at 100 Marine Parkway, Suite 500, Redwood City, California 94065, and the entity named below as "OEM" ("OEM"), having a principal address as set forth below. OEM: Digital Certificates International, Inc., a Delaware corporation - -------------------------------------------------------------------------------- (Name and jurisdiction of incorporation) OEM Address: 100 Marine Parkway, Suite 500 - -------------------------------------------------------------------------------- Redwood City, CA 94065 - -------------------------------------------------------------------------------- OEM Legal Contact: David Cowan, Chairman of the Board - -------------------------------------------------------------------------------- (617) 237-6050 - -------------------------------------------------------------------------------- (name, telephone and title) OEM Billing Contact: D. James Bidzos, President (415) 595-8782 - -------------------------------------------------------------------------------- (name, telephone and title) OEM Technical Contact: George Parsons (415) 595-8782 - -------------------------------------------------------------------------------- (name, telephone and title) OEM Commercial Contact: ________________________________________________________________________________ (name, telephone and title) OEM Initial P.O. Number: ________________________________________________________________________________ Territory: [_] United States of America [_] North America [X] Worldwide; provided, however, that OEM shall not grant licenses for use of the Bundled Product in any foreign country where the terms of the license agreement would not provide the intellectual property protections intended to be provided by such license, or where there is a significant risk that the RSA Software or any part thereof would thereby fall into the public domain. If OEM wishes to grant a license in a particular country, RSA will consider in good faith any information provided by OEM to reasonably determine within thirty (30) calendar days whether RSA believes licenses granted in such country would meet the requirements set forth in this paragraph. EXHIBIT "C" SPECIAL TERMS AND CONDITIONS ATTACHED: YES [_] NO [X] RSA Data Security, Inc. OEM Master License Agreement Page 2 1. DEFINITIONS ----------- The following terms when used in this Agreement shall have the following meanings: 1.1 "BUNDLED PRODUCTS" means one or more of the specific products described on a License/Product Schedule attached hereto and referencing this Agreement which has been or will be developed by OEM and which incorporates in the OEM Product in any manner any portion of the RSA Object Code. A Bundled Product must represent a significant functional and value enhancement to the Licensed Software such that the primary reason for an End User Customer to license such Bundled Product is other than the right to receive a license to the Licensed Software included in the Bundled Product. 1.2 "DISTRIBUTOR" means a dealer or distributor in the business of reselling or sublicensing Bundled Products by virtue of authority of OEM. Bundled Products resold and sublicensed by a Distributor shall bear OEM's trademarks and service marks and shall not be privately labeled by such Distributor or other parties. A Distributor shall have no right to modify any part of the Licensed Software. 1.3 "END USER CUSTOMER" means a person or entity sublicensing RSA Object Code as part of a Bundled Product from OEM or a Distributor solely for personal or internal use and without right to sublicense, assign or otherwise transfer such Bundled Product to any other person or entity. 1.4 "LICENSE/PRODUCT SCHEDULE" shall mean a schedule substantially in the form of Exhibit "A" hereto completed and executed with respect to each Bundled Product specifying the Licensed Software and Licensed Functionality with respect to such Bundled Product. A License/Product Schedule can be amended pursuant to Section 9.5 to provide additional Licensed Software or Licensed Functionality with respect to a specified Bundled Product. Additional Bundled Products may be added to this License Agreement by executing an additional License/Product Schedule referencing this Agreement. All such License/Product Schedules are incorporated in this Agreement by this reference. 1.5 "INTERFACE MODIFICATIONS" shall have the meaning set forth in Section 2.1.1. 1.6 "KNOW-HOW" shall have the meaning set forth in Section 6.4.1. 1.7 "LICENSE FEES" shall have the meaning set forth in Section 3.1. 1.8 "LICENSED FUNCTIONALITY" means with respect to the Licensed Software for a Bundled Product the functionality specified on the License/Product Schedule for such Bundled Product. 1.9 "LICENSED SOFTWARE" means those algorithms and other technology components of the RSA Software specified on page 2 of a License/Product Schedule hereto as having been licensed by OEM. Only those portions of the RSA Software specified as having been licensed are included in the Licensed Software. Licensed Software shall be specified by Bundled Product and OEM may elect as set forth on the License/Product Schedule to license different Licensed Software with respect to different Bundled Products. 1.10 "NEW RELEASE" means a version of the RSA Software which shall generally be designated by a new version number which has changed from the prior number only to the right of the decimal point (e.g., Version 2.2 to Version 2.3). 1.11 "NEW VERSION" means a version of the RSA Software which shall generally be designated by a new version number which has changed from the prior number to the left of the decimal point (e.g., Version 2.3 to Version 3.0). 1.12 "OEM PRODUCT" means any product developed by OEM which is to be bundled with the Licensed Software or into which the Licensed Software is to be incorporated to create a Bundled Product. 1.13 "RSA OBJECT CODE" means the Licensed Software in machine-readable, compiled object code form. 1.14 "RSA SOFTWARE" means RSA proprietary software known as BSAFE and TIPEM as described in the User Manuals associated RSA Data Security, Inc. OEM Master License Agreement Page 3 therewith. "RSA Software" shall also include all modifications and enhancements (including all New Releases and New Versions) to such programs as provided by RSA to OEM. 1.15 "RSA SOURCE CODE" means the mnemonic, high level statement versions of the Licensed Software written in the source language used by programmers. 1.16 "TERRITORY" means those countries or portions of countries listed on page 1 hereof. 1.17 "USER MANUAL" means the most current version of the user manual customarily supplied by RSA to end users who license the RSA Object Code. 2. GRANT OF LIMITED LICENSES ------------------------- 2.1 RSA SOURCE CODE LICENSE. If a source code license is specified in a ----------------------- License/Product Schedule, RSA hereby grants OEM a non-exclusive, non- transferable (except as provided in Section 9.2), license during the term specified in Section 8 to use no more than five (5) copies of the RSA Source Code each on a standalone computer (or one (1) copy on a network accessed by not more than five (5) simultaneous users) to: 2.1.1 Modify the RSA Source Code to create ports, interfaces and other software necessary to permit the Licensed Software to operate in accordance with the User Manual in any of OEM's proprietary products (all such modifications to the RSA Source Code referenced collectively as "Interface Modifications"). 2.1.2 Modify that portion of the RSA Source Code consisting of the ECA Tools module of TIPEM for the purpose of creating Bundled Products (all such modifications to the RSA Source Code referenced collectively as "ECA Tools Modifications"). 2.1.3 Provide support of Bundled Products to End User Customers. 2.1.4 Compile the RSA Source Code to create object code solely to permit creation of Interface Modifications and ECA Tools Modifications and for the purposes set forth in Section 2.2 (with the limitations set forth in Section 2.3). 2.2 OBJECT CODE LICENSE. OEM may incorporate from the RSA Software into ------------------- Bundled Products the specified portions and functionality of the RSA Software as set forth on the License/Product Schedule; additional portions and functionality of the RSA Software can be added and additional Bundled Products can be added by executing an amendment to a License/Product Schedule and a new License/Product Schedule, respectively. RSA hereby grants OEM a non-exclusive, non- transferable (except as provided in Section 9.2), license during the term specified in Section 8 to: 2.2.1 Incorporate the Licensed Functionality of the RSA Object Code into the OEM Product to create a Bundled Product. 2.2.2 Reproduce and have reproduced the Licensed Functionality of the RSA Object Code incorporated in a Bundled Product and the User Manual as reasonably needed for inactive backup or archival purposes. 2.2.3 Reproduce, have reproduced, and sublicense the Licensed Functionality of the RSA Object Code and the User Manual incorporated in a Bundled Product in the Territory. 2.3 LIMITATIONS ON LICENSES. The licenses granted in Sections 2.1 and 2.2 ----------------------- shall be limited as follows: 2.3.1 Sublicenses of the RSA Object Code to Licensed Software shall be granted only to (i) Distributors and (ii) End User Customers. 2.3.2 OEM may not in any way sell, rent, license, sublicense or otherwise distribute the RSA Software or any part thereof or the right to use the RSA Software or any part thereof as a stand-alone product to any person or entity. 2.3.3 If Licensed Software with respect to a Bundled Product has a specified Licensed Functionality restriction, it may be incorporated, reproduced, or sublicensed with respect to any or all functionality of such Licensed Software except as so restricted and OEM shall have no rights with RSA Data Security, Inc. OEM Master License Agreement Page 4 respect to such restricted functionality for such Bundled Product. If no Licensed Functionality restriction is specified for an item of Licensed Software with respect to a Bundled Product, then OEM shall have the rights set forth in Section 2.2 with respect to all functionalities of such Licensed Software with respect to such Bundled Product. 2.3.4 OEM may not copy or reproduce the RSA Software or any part, version or form thereof, except as expressly permitted in Section 2.2. 2.4 TITLE. ----- 2.4.1 Except for the limited licenses granted in Sections 2.1 and 2.2, RSA shall at all times retain full and exclusive right, title and ownership interest in and to the RSA Software and in any and all related patents, trademarks, copyrights or proprietary or trade secret rights. 2.4.2 OEM shall at all times retain full and exclusive right, title and ownership interest in and to the Interface Modifications and ECA Tools Modifications representing incremental modifications to the RSA Software (but not in any part of the RSA Software, either as a component of a derivative work or otherwise) and in any and all related copyrights or proprietary or trade secret rights; provided, however, that OEM hereby agrees that it will not assert against RSA any of such copyrights or proprietary or trade secret rights with respect to any interfaces independently developed by RSA without reference to the source code to the Interface Modifications; and provided, further, that OEM hereby grants to RSA a non-exclusive, non-transferable, worldwide, perpetual, royalty-free license to use, reproduce, have reproduced and sublicense the ECA Tools Modifications, subject to the payment of royalties to a third party whose software is included in the ECA Tools Modifications if RSA has, after having been given notice of such royalties, accepted a license for such third-party software. Notwithstanding the foregoing, if the Board of Directors of OEM determines in good faith that any ECA Tools Modification provides a significant competitive advantage to OEM that would be lost by granting a royalty-free license to RSA, then the Board of Directors of OEM may elect not to provide a royalty-free license of such ECA Tools Modifications to RSA, but will negotiate in good faith with RSA for a license to such ECA Tools Modifications on such terms and conditions as the parties may agree. 3. LICENSE FEES ------------ 3.1 LICENSE FEES. The entire consideration for any and all licenses granted ------------ herein is the issuance to RSA of stock in OEM as reflected in that certain Founders Subscription Agreement between RSA and OEM of even date herewith. 3.2 TAXES. All taxes, duties, fees and other governmental charges of any ----- kind (including sales and use taxes, but excluding United States or California taxes based on the gross revenues or net income of RSA) which are imposed by or under the authority of any government or any political subdivision thereof on the License Fees or any aspect of this Agreement shall be borne by OEM and shall not be considered a part of, a deduction from or an offset against, the License Fees. 4. SUPPORT AND MAINTENANCE ----------------------- 4.1 MAINTENANCE. RSA shall provide maintenance as set forth in Section 4.3 ----------- for no charge. RSA may cease to offer maintenance for any version or any product by notice delivered to OEM ninety (90) days before the termination date if RSA generally ceases to offer maintenance to its licensees of the same version or product. The limited warranty in Section 7.1 shall not affect RSA's maintenance obligations under this Section 4. 4.2 ADDITIONAL CHARGES. In the event RSA is required to take actions to ------------------ correct a difficulty or defect which is traced to OEM errors, modifications, enhancements, software or hardware, then OEM shall pay to RSA its time and materials charges at RSA's rates then in effect. In the event RSA's personnel must travel to perform maintenance or on-site support, OEM shall reimburse RSA for any reasonable out-of-pocket expenses incurred, including travel to and from OEM's sites, lodging, meals and shipping, as may be necessary in connection with duties performed under this Section 4 by RSA. RSA Data Security, Inc. OEM Master License Agreement Page 5 4.3 MAINTENANCE PROVIDED BY RSA. For all portions of the RSA Software as to --------------------------- which maintenance is in effect, RSA will provide OEM with the following services: 4.3.1 RSA will provide telephone support to OEM during RSA's normal business hours. RSA may provide on-site support reasonably determined to be necessary by RSA at OEM's location specified on page 1 hereof. RSA shall provide the support specified in this Section 4.3.1 to OEM's employees responsible for developing Bundled Products, maintaining Bundled Products, and providing support to End User Customers. No more than two (2) OEM employees may obtain such support from RSA at any one time. On RSA's request, OEM will provide a list with the names of the employees designated to receive support from RSA. OEM may change the names on the list at any time by providing written notice to RSA. 4.3.2 In the event OEM discovers an error in the Licensed Functionality of the Licensed Software which causes the Licensed Functionality of the Licensed Software not to operate in material conformance to RSA's published specifications therefor, OEM shall submit to RSA a written report describing such error in sufficient detail to permit RSA to reproduce such error. Upon receipt of any such written report, RSA will use its reasonable business judgment to classify a reported error as either: (i) a "Level 1 Severity" error, meaning an error that causes the Licensed Functionality of the Licensed Software to fail to operate in a material manner or to produce materially incorrect results and for which there is no workaround or only a difficult workaround; or (ii) a "Level 2 Severity" error, meaning an error that produces a situation in which the Licensed Functionality of the Licensed Software is usable but does not function in the most convenient or expeditious manner, and the use or value of the Licensed Functionality of the Licensed Software suffers no material impact. RSA will acknowledge receipt of a conforming error report within two (2) business days and (A) will use its continuing best efforts to provide a correction for any Level 1 Severity error to OEM as early as practicable; and (B) will use its reasonable efforts to include a correction for any Level 2 Severity error in the next release of the RSA Software. 4.3.3 RSA will provide OEM information relating to New Releases and New Versions of the RSA Software during the term of this Agreement. New Releases and New Versions will be provided at no charge, subject to the payment of royalties to a third party whose software is included in the New Release or New Version if OEM has, after having been given notice of such royalties, accepted a license for such New Release or New Version. Any New Releases or New Versions acquired by OEM shall be governed by all of the terms and provisions of this Agreement. 4.4 NOTIFICATION OF ERRORS. RSA shall notify OEM of any errors in the RSA ---------------------- Software of which RSA becomes aware on the same basis as it generally so notifies its other licensees of the RSA Software. 5. MASTER COPY ----------- As soon as practicable but not later than five (5) business days after the date of execution of a License/Product Schedule RSA shall deliver to OEM one (1) copy of each of the RSA Object Code, the RSA Source Code (if licensed hereunder) and the User Manual. 6. ADDITIONAL OBLIGATIONS OF OEM ----------------------------- 6.1 BUNDLED PRODUCT MARKETING. OEM is authorized to represent to ------------------------- Distributors and End User Customers only such facts about the RSA Software as RSA states in its published product descriptions, advertising and promotional materials or as may be stated in other non-confidential written material furnished by RSA. 6.2 CUSTOMER SUPPORT. OEM shall, at its expense, provide all support for ---------------- the Bundled Products to Distributors and End User Customers. 6.3 LICENSE AGREEMENTS. OEM shall cause to be delivered to each Distributor ------------------ and End User Customer a license agreement which shall contain, at a minimum, substantially all of the limitations of rights and the protections for RSA which are contained in Sections 2.3, 6.4.2, 6.6, 7.2, 7.3, 9.8 and 9.9 of this Agreement and shall prohibit Distributors and End User Customers pursuant to written agreements from modifying, reverse RSA Data Security, Inc. OEM Master License Agreement Page 6 engineering, decompiling or disassembling the RSA Object Code or any part thereof. OEM shall use commercially reasonable efforts to ensure that all Distributors and End User Customers abide by the terms of such agreements. 6.4 CONFIDENTIALITY; PROPRIETARY RIGHTS. ----------------------------------- 6.4.1 Each party acknowledges that in the performance of its respective duties under this Agreement, each may disclose to the other its confidential and proprietary know-how, technology, techniques or marketing plans, and, in the case of RSA, the RSA Source Code (collectively, the "KNOW-HOW"). Each party -------- agrees to hold the other's Know-How within its own organization and shall not, without specific written consent of the other party or as expressly authorized herein, utilize in any manner, publish, communicate or disclose any part of the Know-How to third parties. This Section 6.4.1 shall impose no obligation on a party with respect to any Know-How which: (i) at the time of disclosure in writing is not marked or stamped with a legend identifying it as "Company Private," "Proprietary," "Confidential" or a similar legend; (ii) is in the public domain at the time disclosed by the other party; (iii) enters the public domain after disclosure other than by breach of the receiving party's obligations hereunder; (iv) is known by the receiving party prior to its receipt from the other party; (v) is independently developed by the receiving party; or (vi) is disclosed pursuant to a requirement of a court, governmental agency, law or regulation, provided that the receiving gives the other party prior notice of such disclosure. 6.4.2 OEM agrees not to remove or destroy any proprietary, trademark or copyright markings or confidentiality legends placed upon or contained within the RSA Source Code, RSA Object Code, User Manuals or any related materials or documentation. OEM further agrees to insert and maintain: (i) within every Bundled Product and any related materials or documentation a copyright notice in the name of OEM; and (ii) within the splash screens, user documentation, printed product collateral, product packaging and advertisements for the Bundled Product, the appropriate RSA "Licensee Seal" from the form attached as Exhibit "B" to this Agreement and a statement that the Bundled Product contains the RSA Software. OEM shall cease to use the markings, or any similar markings, in any manner on the expiration or other termination of the license rights granted pursuant to Section 2. 6.4.3 OEM acknowledges the extreme importance of the confidentiality and trade secret status of the RSA Source Code and OEM agrees, in addition to complying with the requirements of Sections 6.4.1 and 6.4.2 as they relate to the RSA Source Code, to: (i) inform any employee that is granted access to all or any portion of the RSA Source Code of the importance of preserving the confidentiality and trade secret status of the RSA Source Code; and (ii) maintain a controlled, secure environment for the storage and use of the RSA Source Code. 6.4.4 OEM shall not modify (except to create Interface Modifications and ECA Tools Modifications), translate, reverse engineer, decompile or disassemble the RSA Software or any part thereof. 6.4.5 The placement of a copyright notice on any of the RSA Software shall not constitute publication or otherwise impair the confidential or trade secret nature of the RSA Software. 6.4.6 OEM acknowledges that the restrictions contained in this Section 6.4 are reasonable and necessary to protect RSA's legitimate interests and that any violation of these restrictions will cause irreparable damage to RSA within a short period of time and OEM agrees that RSA will be entitled to injunctive relief against each violation. OEM further agrees that all confidentiality commitments hereunder shall survive the expiration or termination for any reason the license rights granted pursuant to Section 2. 6.5 FEDERAL GOVERNMENT SUBLICENSE. Any sublicense of a Bundled Product ----------------------------- acquired from OEM or any Distributor under a United States government contract shall be subject to restrictions as set forth in subparagraph (c)(1)(ii) of Defense Federal Acquisition Regulations Supplement (DFARs) Section 252.227-7013 for Department of Defense contracts and as set forth in Federal Acquisition Regulations (FARs) Section 52.227-19 for civilian agency contracts or any RSA Data Security, Inc. OEM Master License Agreement Page 7 successor regulations. OEM agrees that any such sublicense shall set forth all of such restrictions and the tape or diskette label for the Bundled Product and any documentation delivered with the Bundled Product shall contain a restricted rights legend conforming to the requirements of the current, applicable DFARs or FARs. 6.6 NOTICES. OEM shall immediately advise RSA of any legal notices served ------- on OEM which might affect RSA, the RSA Software or any Bundled Products. 6.7 INDEMNITY. OEM EXPRESSLY INDEMNIFIES AND HOLDS HARMLESS RSA, ITS --------- SUBSIDIARIES, AGENTS AND AFFILIATES FROM: (i) ANY AND ALL LIABILITY OF ANY KIND OR NATURE WHATSOEVER TO OEM'S END USER CUSTOMERS, DISTRIBUTORS AND THIRD PARTIES WHICH MAY ARISE FROM ACTS OF OEM OR FROM THE LICENSE OF BUNDLED PRODUCTS BY OEM OR ANY DOCUMENTATION, SERVICES OR ANY OTHER ITEM FURNISHED BY OEM TO ITS END USER CUSTOMERS OR DISTRIBUTORS (OTHER THAN LIABILITY ARISING FROM THE UNMODIFIED RSA SOFTWARE); AND (ii) ANY LIABILITY ARISING IN CONNECTION WITH AN UNAUTHORIZED REPRESENTATION OR ANY MISREPRESENTATION OF FACT MADE BY OEM OR ITS AGENTS, EMPLOYEES OR DISTRIBUTORS TO ANY PARTY WITH RESPECT TO THE RSA SOFTWARE OR ANY BUNDLED PRODUCTS. 7. LIMITED WARRANTY; DISCLAIMER OF WARRANTIES; LIMITATION OF LIABILITY; -------------------------------------------------------------------- INTELLECTUAL PROPERTY INDEMNITIES - --------------------------------- 7.1 LIMITED WARRANTY. During the initial one (1)-year period of this ---------------- Agreement, RSA warrants that the Licensed Functionality of the Licensed Software specified in such License/Product Schedule will operate in material conformance to RSA's published specifications for such Licensed Functionality of the Licensed Software. RSA does not warrant that the RSA Software or any portion thereof is error-free. OEM's exclusive remedy, and RSA's entire liability in tort, contract or otherwise for any warranted nonconformity under this Section 7.1, shall be correction of any warranted nonconformity as provided in Section 4.3.2. This limited warranty and any obligations of RSA under Section 4.1 shall not apply to any Interface Modifications or ECA Tools Modifications or any nonconformities caused thereby and shall terminate immediately if OEM makes any modification to the RSA Software other than Interface Modifications or ECA Tools Modifications. 7.2 DISCLAIMER. EXCEPT FOR THE EXPRESS LIMITED WARRANTY PROVIDED IN SECTION ---------- 7.1, THE RSA SOFTWARE IS PROVIDED "AS IS" WITHOUT ANY WARRANTY WHATSOEVER. RSA DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO ANY MATTER WHATSOEVER, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. RSA DISCLAIMS ANY WARRANTY OR REPRESENTATION TO ANY PERSON OTHER THAN OEM WITH RESPECT TO THE RSA SOFTWARE. OEM SHALL NOT, AND SHALL TAKE ALL MEASURES NECESSARY TO INSURE THAT ITS AGENTS AND EMPLOYEES DO NOT, MAKE OR PASS THROUGH ANY SUCH WARRANTY ON BEHALF OF RSA TO ANY DISTRIBUTOR, END USER CUSTOMER OR OTHER THIRD PARTY. 7.3 LIMITATION OF LIABILITY. EXCEPT WITH RESPECT TO RSA'S OBLIGATIONS UNDER ----------------------- SECTION 7.4, IN NO EVENT WILL RSA BE LIABLE TO OEM (OR TO ANY PERSON CLAIMING RIGHTS DERIVED FROM OEM) FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES ARISING OUT OF OR RSA Data Security, Inc. OEM Master License Agreement Page 8 RELATED TO THE TRANSACTIONS CONTEMPLATED UNDER THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO LOST PROFITS, BUSINESS INTERRUPTION OR LOSS OF BUSINESS INFORMATION, EVEN IF RSA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 7.4 PROPRIETARY RIGHTS INFRINGEMENT BY RSA. -------------------------------------- 7.4.1 Subject to the limitations set forth in this Section 7.4, RSA, at its own expense, shall: (i) defend, or at its option settle, any claim, suit or proceeding against OEM on the basis of infringement of any United States patent, copyright, trade secret or other intellectual property right by the Bundled Product to the extent it arises from the unmodified Licensed Software as delivered by RSA (excluding the Interface Modifications and ECA Tools Modifications) or any claim that RSA has no right to license the Licensed Software hereunder; and (ii) pay any final judgment entered or settlement against OEM on such issue in any such suit or proceeding defended by RSA. RSA shall have no obligation to OEM pursuant to this Section 7.4.1 unless: (A) OEM gives RSA prompt written notice of the claim; (B) RSA is given the right to control and direct the investigation, preparation, defense and settlement of the claim; and (C) the claim is based on OEM's use of the most recent version or the immediately preceding version of the unmodified Licensed Software in accordance with this Agreement. 7.4.2 If RSA receives notice of an alleged infringement described in Section 7.4.1, RSA shall have the right, at its sole option, to obtain the right to continue use of the Licensed Software or to replace or modify the Licensed Software so that it is no longer infringing. 7.4.3 THE RIGHTS AND REMEDIES SET FORTH IN SECTIONS 7.4.1 AND 7.4.2 CONSTITUTE THE ENTIRE OBLIGATION OF RSA AND THE EXCLUSIVE REMEDIES OF OEM CONCERNING PROPRIETARY RIGHTS INFRINGEMENT BY THE LICENSED SOFTWARE. 7.5 PROPRIETARY RIGHTS INFRINGEMENT BY OEM. -------------------------------------- 7.5.1 Subject to the limitations set forth in this Section 7.5, OEM, at its own expense, shall: (i) defend, or at its option settle, any claim, suit or proceeding against RSA on the basis of infringement of any United States patent, copyright or trade secret by any Bundled Product (except to the extent arising from the unmodified RSA Software) or the Interface Modifications or ECA Tools Modifications; and (ii) pay any final judgment entered or settlement against RSA on such issue in any such suit or proceeding defended by OEM. OEM shall have no obligation to RSA pursuant to this Section 7.5.1 unless: (A) RSA gives OEM prompt written notice of the claim; and (B) OEM is given the right to control and direct the investigation, preparation, defense and settlement of the claim. 7.5.2 If OEM receives notice of an alleged infringement described in Section 7.5.1, OEM shall have the right, at its sole option, to obtain the right to continued use of the Interface Modifications, ECA Tools Modifications or the Bundled Product or to replace or modify the Interface Modifications, ECA Tools Modifications or Bundled Product so that they are no longer infringing. If neither of the foregoing options in this Section 7.5.2 is reasonably available to OEM, then the license rights granted pursuant to Section 2 of this Agreement may be terminated at the option of OEM without further obligation or liability except as provided in Sections 7.5.1 and 8.3, and in the event of such termination, RSA shall retain all License Fees paid by OEM hereunder. 7.5.3 THE RIGHTS AND REMEDIES SET FORTH IN SECTIONS 7.5.1 AND 7.5.2 CONSTITUTE THE ENTIRE OBLIGATION OF OEM AND THE EXCLUSIVE REMEDIES OF RSA CONCERNING OEM'S PROPRIETARY RIGHTS INFRINGEMENT. 8. TERM AND TERMINATION -------------------- 8.1 TERM. The license rights granted pursuant to Section 2 shall be ---- effective with respect to each License/Product Schedule as of the date thereof and shall continue in full force and effect for each item of Licensed Software for RSA Data Security, Inc. OEM Master License Agreement Page 9 the period set forth on the applicable License/Product Schedule unless sooner terminated pursuant to the terms of this Agreement. Either party shall be entitled to terminate all the license rights granted pursuant to this Agreement at any time on written notice to the other in the event of a default by the other party and a failure to cure such default within a period of one hundred twenty (120) days following receipt of written notice specifying that a default has occurred or, if any such default is incapable of being cured within such period, a failure within such one-hundred-twenty (120)-day period to commence and diligently pursue a cure; provided, however, that in no event shall a defaulting party have more than one hundred eighty (180) days after receipt of written notice of a default to cure such default. 8.2 INSOLVENCY. In the event that either party is adjudged insolvent or ---------- bankrupt, or upon the institution of any proceedings by or against either party seeking relief, reorganization or arrangement under any laws relating to insolvency, or upon any assignment for the benefit of creditors, or upon the appointment of a receiver, liquidator or trustee of any of either party's property or assets, or upon the liquidation, dissolution or winding up of either party's business, then and in any such events all the license rights granted pursuant to this Agreement may immediately be terminated by the other party upon giving written notice. 8.3 DISPOSITION OF RSA SOFTWARE AND USER MANUALS ON TERMINATION. Upon the ----------------------------------------------------------- expiration or termination pursuant to this Section 8 of the license rights granted pursuant to Section 2, the remaining provisions of this Agreement shall remain in full force and effect, and OEM shall cease making copies of, using or licensing the RSA Software and Bundled Products excepting only such copies of Bundled Products necessary to fill orders placed with OEM prior to such expiration or termination. OEM shall destroy all copies of the RSA Software and Bundled Products not subject to any then-effective license agreement with an End User Customer and all information and documentation provided by RSA to OEM (including all Know-How), other than such copies of the RSA Object Code, the User Manual and the Bundled Products as are necessary to enable OEM to perform its continuing support obligations in accordance with Section 6.2, if any, and except as provided in the next following sentence. If OEM has licensed RSA Source Code hereunder, for a period of one (1) year after the date of expiration or termination of the license rights granted under this Agreement for any reason other than as a result of default by OEM, OEM may retain one (1) copy of the RSA Source Code and is hereby licensed for such term to use such RSA Source Code solely for the purpose of supporting End User Customers of Bundled Products. Upon the expiration of such one (1)-year period, OEM shall destroy or return to RSA such single copy of the RSA Source Code. 9. MISCELLANEOUS PROVISIONS ------------------------ 9.1 GOVERNING LAWS. IT IS THE INTENTION OF THE PARTIES HERETO THAT THE -------------- INTERNAL LAWS OF THE STATE OF CALIFORNIA, U.S.A. (IRRESPECTIVE OF ITS CHOICE OF LAW PRINCIPLES) SHALL GOVERN THE VALIDITY OF THIS AGREEMENT, THE CONSTRUCTION OF ITS TERMS, AND THE INTERPRETATION AND ENFORCEMENT OF THE RIGHTS AND DUTIES OF THE PARTIES HERETO. THE PARTIES AGREE THAT THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS SHALL NOT APPLY TO THIS AGREEMENT. THE PARTIES HEREBY AGREE THAT ANY SUIT TO ENFORCE ANY PROVISION OF THIS AGREEMENT OR ARISING OUT OF OR BASED UPON THIS AGREEMENT OR THE BUSINESS RELATIONSHIP BETWEEN THE PARTIES HERETO SHALL BE BROUGHT IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF CALIFORNIA OR THE SUPERIOR OR MUNICIPAL COURT IN AND FOR THE COUNTY OF SAN MATEO, CALIFORNIA, U.S.A. Each party hereby agrees that such courts shall have exclusive in personam ----------- jurisdiction and venue with respect to such party, and each party hereby submits to the exclusive in personam jurisdiction and venue of such courts. ----------- 9.2 BINDING UPON SUCCESSORS AND ASSIGNS. Except as otherwise provided ----------------------------------- herein, this Agreement shall be binding upon, and inure to the benefit of, the successors, executors, heirs, representatives, administrators and assigns of the parties hereto; provided, however, that this Agreement shall not be assignable by OEM, by RSA Data Security, Inc. OEM Master License Agreement Page 10 operation of law or otherwise, without the prior written consent of RSA, which shall not be unreasonably withheld except that RSA's consent shall not be required (if RSA is given notice within thirty (30) days after such assignment) for an assignment of this Agreement resulting from a merger, reorganization, reincorporation or other acquisition of OEM. Any such purported assignment or delegation in violation of this Section shall be void and of no effect. 9.3 SEVERABILITY. If any provision of this Agreement, or the application ------------ thereof, shall for any reason and to any extent, be invalid or unenforceable, the remainder of this Agreement and application of such provision to other persons or circumstances shall be interpreted so as best to reasonably effect the intent of the parties hereto. IT IS EXPRESSLY UNDERSTOOD AND AGREED THAT EACH AND EVERY PROVISION OF THIS AGREEMENT WHICH PROVIDES FOR A LIMITATION OF LIABILITY, DISCLAIMER OF WARRANTIES OR EXCLUSION OF DAMAGES IS INTENDED BY THE PARTIES TO BE SEVERABLE AND INDEPENDENT OF ANY OTHER PROVISION AND TO BE ENFORCED AS SUCH. 9.4 ENTIRE AGREEMENT. This Agreement and the exhibits and schedules hereto ---------------- constitute the entire understanding and agreement of the parties hereto with respect to the subject matter hereof and supersede all prior and contemporaneous agreements or understandings between the parties. 9.5 AMENDMENT AND WAIVERS. Any term or provision of this Agreement may be --------------------- amended, and the observance of any term of this Agreement may be waived, only by a writing signed by the party to be bound thereby. 9.6 ATTORNEYS' FEES. Should suit be brought to enforce or interpret any --------------- part of this Agreement, the prevailing party shall be entitled to recover, as an element of the costs of suit and not as damages, reasonable attorneys' fees to be fixed by the court (including without limitation, costs, expenses and fees on any appeal). 9.7 NOTICES. Whenever any party hereto desires or is required to give any ------- notice, demand, or request with respect to this Agreement, each such communication shall be in writing and shall be effective only if it is delivered by personal service or mailed, United States certified or registered mail, postage prepaid, return receipt requested, addressed as follows: RSA: To the address set forth on page 1 If to RSA, with a copy to: Timothy Tomlinson, Esq. Tomlinson Zisko Morosoli & Maser 200 Page Mill Road, Second Floor Palo Alto, California 94306 OEM: To the address set forth on page 1 Such communications shall be effective when they are received by the addressee thereof; but if sent by certified or registered mail in the manner set forth above, they shall be effective five (5) days after being deposited in the United States mail in the contiguous 48 states or ten (10) days after being deposited in the United States mail in any other location. Any party may change its address for such communications by giving notice thereof to the other party in conformity with this Section. 9.8 FOREIGN RESHIPMENT LIABILITY. THIS AGREEMENT IS EXPRESSLY MADE SUBJECT ---------------------------- TO ANY LAWS, REGULATIONS, ORDERS OR OTHER RESTRICTIONS ON THE EXPORT FROM THE UNITED STATES OF AMERICA OF THE RSA SOFTWARE OR BUNDLED PRODUCTS OR OF INFORMATION ABOUT SUCH RSA SOFTWARE OR BUNDLED PRODUCTS WHICH MAY BE IMPOSED FROM TIME TO TIME BY THE GOVERNMENT OF THE UNITED STATES OF AMERICA. NOTWITHSTANDING ANYTHING CONTAINED IN THIS AGREEMENT TO THE CONTRARY, OEM SHALL NOT EXPORT OR REEXPORT, DIRECTLY OR INDIRECTLY, ANY RSA SOFTWARE OR BUNDLED PRODUCTS OR INFORMATION PERTAINING THERETO TO ANY COUNTRY FOR WHICH SUCH GOVERNMENT OR ANY AGENCY THEREOF REQUIRES AN EXPORT LICENSE OR OTHER GOVERNMENTAL APPROVAL AT THE TIME OF EXPORT OR REEXPORT WITHOUT FIRST OBTAINING SUCH LICENSE OR APPROVAL. 9.9 TRADE NAMES, LOGOS; PUBLICITY. By reason of this Agreement or the ----------------------------- performance RSA Data Security, Inc. OEM Master License Agreement Page 11 hereof, OEM shall acquire no rights of any kind in any RSA trademark, trade name, logo or product designation under which the RSA Software was or is marketed and OEM shall not make any use of the same for any reason except as expressly authorized by this Agreement or otherwise authorized in writing by RSA. RSA shall have the right during the term of the license rights granted hereunder to disclose to third parties that OEM is an OEM of the RSA Software and that any publicly-announced Bundled Product incorporates the RSA Software. OEM shall provide to RSA, solely for RSA's display purposes, one (1) working copy of each Bundled Product which consists solely of computer software and one (1) working or non-working unit of any hardware product in which is incorporated a Bundled Product which consists of an integrated circuit or other hardware. IN WITNESS WHEREOF, the parties have executed this Agreement as of the day and year first written above. OEM: DIGITAL CERTIFICATES INTERNATIONAL, INC. By: /s/ David Cowan -------------------------------------- Printed Name: David Cowan --------------------------- Title: Chairman of the Board ---------------------------------- RSA DATA SECURITY, INC. By: /s/ D. James Bidzos -------------------------------------- Printed Name: D. James Bidzos --------------------------- Title: President --------------------------------- License/Schedule Number: _________________________________ Date of this License/Product Schedule: April 18, 1995 EXHIBIT "A" LICENSE/PRODUCT SCHEDULE OEM: Digital Certificates International, Inc. - -------------------------------------------------------------------------------- OEM Master License Agreement Number: ________________________________________________________________________________ Date of OEM Master License Agreement: April 17, 1995 - -------------------------------------------------------------------------------- This License/Product Schedule Amends Schedules Dated: N/A - -------------------------------------------------------------------------------- Term of Agreement for this Bundled Product: Perpetual - -------------------------------------------------------------------------------- Bundled Product: CIS Software - Certificate Issuing Software including the user interface and - -------------------------------------------------------------------------------- management of the CIS hardware and certificate database; CSC CIS - internal - -------------------------------------------------------------------------------- software used to manage certificate services; SoftCIS - software-only - -------------------------------------------------------------------------------- certificate issuing product; Persona Responder - automatic, anonymous - -------------------------------------------------------------------------------- certificate issuing for Internet user's testing and play; Co-Issuer Tool - - -------------------------------------------------------------------------------- software that allows co-issuer customers to preview certificate requests and - -------------------------------------------------------------------------------- forward them to certificate service provider; and Co-Signer Software - software - -------------------------------------------------------------------------------- that allows certificate services provider to manage private keys and sign data - -------------------------------------------------------------------------------- and other files on behalf of co-signer customers. RSA agrees that the foregoing - -------------------------------------------------------------------------------- meet the requirements of Bundled Products set forth in Section 1.1 of the - -------------------------------------------------------------------------------- Agreement. In addition, upon the request of OEM, RSA will grant royalty-free - -------------------------------------------------------------------------------- licenses under this Agreement for additional specified Bundled Products, if RSA - -------------------------------------------------------------------------------- determines in its reasonable discretion that such products are reasonably - -------------------------------------------------------------------------------- necessary for the implementation of the Strategic Business Plan of Digital - -------------------------------------------------------------------------------- Certificates International, Version 2.0, dated November 1994. - -------------------------------------------------------------------------------- RSA Software: TIPEM and BSAFE - -------------------------------------------------------------------------------- RSA Software Distribution Method: ____________ Tangible Media or X Electronic Transmission - ------------ RSA Data Security, Inc. Exhibit "A" Page 2 SOURCE AND OBJECT CODE LICENSES - ------------------------------- LICENSED SOFTWARE AND FUNCTIONALITY FOR THIS BUNDLED PRODUCT: SOURCE CODE LICENSE OBJECT LICENSED DESCRIBE CODE LICENSE FUNCTIONALITY LICENSED RESTRICTION FUNCTIONALITY RESTRICTION BSAFE YES NO YES NO YES NO RSA Public Key Cryptosystem [X] [_] [X] [_] [_] [X] Diffie-Hellman Key [X] [_] [X] [_] [_] [X] Negotiation Data Encryption Standard (DES) [X] [_] [X] [_] [_] [X] Extended Data Encryption [X] [_] [X] [_] [_] [X] Standard (DESX) RC2 Variable-Key Size [X] [_] [X] [_] [_] [X] Symmetric Block Cipher RC4 Variable-Key Size [X] [_] [X] [_] [_] [X] Symmetric Stream Cipher MD Hashing Algorithm [X] [_] [X] [_] [_] [X] MD2 Hashing Algorithm [X] [_] [X] [_] [_] [X] MD5 Hashing Algorithm [X] [_] [X] [_] [_] [X] TIPEM (all set forth below) [X] [_] [X] [_] [_] [X] RSA Public Key Cryptosystem Data Encryption Standard (DES) RC2 Variable Key Size Symmetric Block Cipher MD2 Hashing Algorithm MD5 Hashing Algorithm ECA Tools RSA Data Security, Inc. Exhibit "A" Page 3 APPROVED: OEM: By: _________________________________ Printed Name: David Cowan ---------------------- Title: Chairman of the Board ----------------------------- RSA DATA SECURITY, INC.: By: _________________________________ Printed Name: D. James Bidzos ---------------------- Title: President ----------------------------- AMENDMENT NUMBER ONE TO BSAFE/TIPEM OEM MASTER LICENSE AGREEMENT THIS AMENDMENT NUMBER ONE TO BSAFE/TIPEM OEM MASTER LICENSE AGREEMENT (the "AMENDMENT") by and between RSA Data Security, Inc., a Delaware corporation --------- ("RSA"), and VeriSign, Inc., a Delaware corporation ("VERISIGN"), is made this - ----- -------- ____ day of May 1996 with respect to that certain BSAFE/TIPEM OEM Master License Agreement dated April 18, 1995 between RSA and VeriSign (the "MASTER ------ AGREEMENT"). R E C I T A L S A. RSA is the holder of four million (4,000,000) shares of the Common Stock of VeriSign. B. VeriSign has requested RSA to amend the Master Agreement and RSA has agreed to such amendment, provided VeriSign amends its Certificate of Incorporation as set forth herein. C. RSA acknowledges that the Amendment of the Master Agreement is in the best interest of RSA and will enhance the value of its Common Stock of VeriSign. A G R E E M E N T NOW, THEREFORE, in reliance on the foregoing Recitals and in consideration of the mutual consideration recited therein and contained herein, the parties agree as follows: 1. This Amendment shall amend the Master Agreement effective as of February __, 1996. 2. DEFINITION OF BUNDLED PRODUCT. The definition of Bundled Product ----------------------------- contained in Exhibit "A" to the Master Agreement is amended to read as follows: "CIS Software - Certificate Issuing Software including the user interface and management of the CIS hardware and certificate database; CSC CIS - internal software used to manage certificate services; SoftCIS - software-only certificate issuing product; Persona Responder - automatic, anonymous certificate issuing for Internet user's testing and play; Co-Issuer Tool - software that allows co-issuer customers to preview certificate requests and forward them to certificate service provider; and Co-Signer Software - software that allows certificate services provider to manage private keys and sign data and other files on behalf of co-signer customers. RSA agrees that the foregoing meet the requirements of Bundled Products set forth in Section 1.1 of the Agreement. In addition, products that provide certificate issuing, management and processing functionality shall be considered Bundled Products hereunder as well as any products that are reasonably necessary for the implementation of the Strategic Business Plan of Digital Certificates International, Version 2.0, dated November 1994. 3. NEW PRODUCTS. A new section 4.3.4 shall be added to the Master ------------ Agreement as follows: 4.3.4 RSA will provide OEM information made generally available by RSA to other OEMs relating to new products which provide certificate issuing, management and processing functionality. Such new software will be provided to OEM for inclusion in Bundled Products during the term of this Agreement at no charge, subject to the payment of royalties to any third parties whose software is included in the new software if OEM, after having been given notice of such royalties, accepts a license for such new software. Any such new software so acquired by OEM shall be governed by all of the terms and provisions of this Agreement, and shall be considered Licensed Software provided under the initial License Schedule and any subsequent then- Amendment Number One to BSAFE/TIPEM OEM Master License Agreement Page 2 existing Licensed Product Schedules. OEM's license to such new software shall be for both source code and object code. RSA shall provide maintenance for such new software in accordance with the Master Agreement. The initial License/Product Schedule dated April 18, 1995 appearing at Exhibit "A" to the Agreement shall be amended by the parties each time OEM elects to license new software under the Master Agreement such that all new software licensed by OEM hereunder shall be included within the definition of "RSA Software" and "Licensed Software." 4. BCERT AND BSET. RSA has notified VeriSign of the existence of its -------------- new products entitled "BCert and BSET." OEM has elected to license BCert and BSET under the Master Agreement. RSA shall deliver the master copy of BCert and BSET as soon as reasonably practicable after RSA has released the production version of BCert and BSET. 5. LICENSE/PRODUCT SCHEDULE. The attached Exhibit "A" License/Product ------------------------ Schedule incorporates the foregoing amendments to the Master Agreement and hereby supersedes and replaces the initial Exhibit "A" to the Master Agreement as of the date hereof. 6. ROOT KEYS. --------- 6.1 RSA or its successors in interest from the Effective Date of this Amendment to September 20, 2000 agrees to use reasonable efforts to sell or lease or license to third parties products that process Certificates (as defined below) and to use reasonable efforts to cause VeriSign's Root Keys (as defined below) to be included in products manufactured by third parties that include RSA products that process Certificates. 6.2 "Certificate" means an octet string (in electronic or printed form) generated by a Certification Authority consisting of the originator's public key (a publicly available mathematical key) and information about the owner of the public key, encrypted with a private key (a privately-held mathematical key corresponding to the public key) to identify the owner of the private key and verify the integrity of the electronic data. 6.3 "Certification Authority" means an entity trusted by one or more Users to create and Sign Certificates. 6.4 "Sign" means to apply a Digital Signature to a message or Certificate. 6.5 "User" means a functional object (e.g. an individual, or a role/office) in a message handling environment that engages in message handling and that is a potential source or destination for messages. 6.6 "Digital Signature" means a One-Way Hash computed on a message or Certificate and encrypted using the private key of the originator of the message or the issuer of the Certificate. Amendment Number one to BSAFE/TIPEM OEM Master License Agreement Page 3 6.7 "One-Way Hash" means an easy to compute function from a large domain into a smaller domain such that it is computationally infeasible to find any two elements of the larger domain that map to the same element of the smaller domain. 6.8 "Root Key" shall mean the then current public hierarchy Root Keys used by VeriSign as the public key corresponding to one of VeriSign's private keys it uses to Sign a Certificate. On or before the Effective Date of this Amendment, VeriSign shall provide RSA with a list of VeriSign's then current public hierarchy Root Keys specifying the name of the hierarchy in which such Root Key resides and specifying the key itself (the "Root Key Schedule"). Such Root Key Schedule shall be executed by the Chief Executive Officer of VeriSign. VeriSign may amend the Root Key Schedule from time to time by delivering to the Chief Executive Officer or President of RSA, an amended and restated Root Key Schedule executed by the Chief Executive Officer or President of VeriSign. At no time shall such schedule contain more than 10 Root Keys. It shall be considered reasonable efforts by RSA to cause third parties to include in products they manufacture that include RSA products that process Certificates if RSA includes VeriSign's Root Key in RSA's products that process Certificates and makes such Root Key accessible to third parties for use in their products. Upon delivery of the initial Root Key Schedule and any amended and restated Root Key Schedule, RSA shall implement any new Root Keys into its products that process Certificates in accordance with RSA's normal release schedule. RSA shall be given reasonable time to implement such new Root Keys in such products and shall not be obligated to issue special releases simply to implement new Root Keys. In any event, RSA shall have not less than 30 days to implement a new Root Key into a new release, such that if RSA has already scheduled a new release of a product prior to expiration of such time, it shall not be required to implement the Root Key in such new version. If VeriSign believes that RSA is not taking reasonable efforts to cause the Company's Root Key to be included in products manufactured by third parties that include RSA products that process Certificates, it shall give written notice to RSA and RSA shall have 30 days to commence using such reasonable efforts. If RSA commences such efforts within such time, no breach of this Amendment shall have occurred. 7. AMENDMENT TO VERISIGN CERTIFICATE OF INCORPORATION. VeriSign agrees -------------------------------------------------- to amend its Certificate of Incorporation to delete Section 5.10 thereof. 8. EFFECTIVE DATE. This Agreement is subject to approval of VeriSign's -------------- Board of Directors and is subject to approval by Security Dynamics, Inc. on behalf of RSA. This Amendment shall become effective upon the date after receipt of the two foregoing approvals that VeriSign's Certificate of Incorporation is amended to delete Section 5.10 thereof. Prior to such date it shall have no force or effect whatsoever. 9. EFFECT OF AMENDMENT. This Amendment is an amendment to the Master ------------------- Agreement, and except as amended hereby, the Master Agreement shall continue in full force and effect. IN WITNESS WHEREOF, the parties have executed this Amendment Number One as of the date first above written. VERISIGN, INC. RSA DATA SECURITY, INC. By: /s/ Stratton Sclavos By: /s/ D. James Bidzos -------------------------- ---------------------------- Stratton Sclavos D. James Bidzos President President