The certificate to this site use to be AES 256 (if I am not mistaken). Now it is RC4, 128 bit keys.

What happened? and Why the change?

The BEAST ran into our way. See e.g. http://ssl.entrust.net/blog/?p=977 or for a more technical article http://www.educatedguesswork.org/2011/0 ... zzodu.html.

RC4+RSA, 128 bit keys is a high secure encryption.

-AES-CBC- ciphers are not high secure anymore because of the BEAST attack. But the insecure part is CBC, not AES.

You may check our SSL encryption and compare it with other SSL webservers at: https://www.ssllabs.com/ssldb/

I get it. To avoid CBC, some companies have been using XTS, which, from what I understand, is more secure.

Funny way of phrasing it!

If this is the case, then what about for the mix servers? I know they are 128 bit but are they vulnerable to the BEAST? Is Jondonym using RC4 128 bits for the mix server cascades?

At the moment this is not supported by the SSL library we are using on our webserver. To keep our maintenance work low, we will stay with the default SSL library of the distributor if it was possible to provide a secure configuration.

JonDonym does not use SSL encryption for mix server traffic. It is not affected by BEAST or any other known attack to SSL encryption.