JonDonym certificates and their meaning

Certificates are used to identify operators of JonDonym services. Typically, a mix cascade consists of two or more consecutive mix servers, operated by different organisations. Only if all of these operators cooperate, the anonymity of users my be revoked. Users of JonDo should consider themself if they trust the operators of a cascade, and if they connect to this service according to this decision. It is therefore crucial that

Certificates are part of so-called cryptographic public key procedures: the organisation identified by a certificate own a private key, and uses it to forge digital signatures. This key must always be kept secret, as everyone could forge such signatures with it. By using the publicly available public key others can check these signatures and can decide, whether they really communicate with the requested organisation. The correlation of identity and public key is proven by a digital certificate. This is an electronic document digitally signed by a so-called certification authority. It is highly recommended to inspect the certificates of each individual server of a mix cascade (click on the individual Mix icons and there on the certificate, respectively).

Certification authorities

The JonDonym service gets insecure against the operator, if the used mix cascade is nominally run by different operators, but in fact all Mixes are under control of a single organisation. Trustwothy certification authorities (CAs) should ensure that operators with different names do really exist as independent entities. Without identity check by one of these authorities Mixes are not usable for JonDo. In the end, you will have to trust in the certification authorities themselves, as they would be able "generate" non-existing operators and thereby run Mixes in the name of others.

In JonDonym, there currently are only two root certification authorities (JonDos GmbH and TU Dresden JAP Team) that have committet themselves to be very careful when certifying operators. Moreover, the certification of Mix operators may also be done by so-called Sub-CAs, whose identity has been confirmed by the root CAs, and who may perform their own certification processes. Sub-CAs are needed if the identity of operators known to the Sub-CA cannot be confirmed by the root CA without doubt, but these operators should nevertheless not be excluded from the JonDonym system. In the end, the users themselves will have to decide whether they want to trust the Sub-CAs or not.

For the future it is planned to perform a multi-party-certification. Then, at least two certification authorities are needed in order to issue a trustworthy certificate. Thereby there is no more need to trust any single certification authority. For three or more certification authorities, even if the secret certificate of a certification authority gets lost or gets invalid in any other way, all other certificates may remain valid.

Mix certificates and operator certificates

Both Mixes and operators of Mixes receive certificates. A CA issues operator certificates for the identity of the operator, who may then generate as many Mix certificates as they like with their certificate. These Mixes or Mix certificates, respective, then correlate with the generating operators without doubt. This means, on the other hand, that information about the location of Mixes is certified by the operator himself, and is therefore not that relyable as the information about the operator.

States of certificates

A certificate is considered as verified only if you trust the certification authority who has issued this certificate. Non-verifyable certificates are generally not trusted as everyone, who knows a little about computer technology, can generate such certificates by himself. The validity of a certificate depends on the time period for which the certificate has been issued. Typically, you should not trust an expired certificate any longer, as it is not clear whether the owner still has the right to offer the service. Certificates may also be revoked, for example if their encryption was broken, the operator turned out to be dubious, or if the private certificate got into the hands of unauthorized persons.

JonDo disallows connections to Mix cascades with at least one untrusted Mix at the moment. Expired or revoked certificates are currently ignored, but are displayed as such. We are currently implementing a cascade filter with a finer granularity.