A witnessed chokepoint for parties who don't trust each other
A neutral, witnessed chokepoint between two parties who don't trust each other — each brings its own certificate authority, and every exchange is forced through the middle.
# The neutral third party opens a session and prints one secret link per party
redoubt-cli witness-init \
--session-name "Data Exchange Q4"
# Each party connects with the link it received over a secure channel,
# using its own trust root
redoubt-cli connect \
--session-url "https://<host>/session/<session-id>?token=<secret>" \
--party-id party-a
# The counterparty does the same with its own link
redoubt-cli connect \
--session-url "https://<host>/session/<session-id>?token=<secret>" \
--party-id party-cDigitalFrontier Redoubt features
Non-bypassable by design
The two parties are never handed a route to each other. Non-connectivity is enforced in depth, so a party can reach only the intermediary and never its counterpart — even a compromised party has no direct line to the other side.
# a party can reach only the intermediary, never the other side
redoubt-cli connect --session-url https://<host>/session/<id>No shared root of trust
Neither party has to accept a shared certificate authority. Each keeps its own trust root, so there is no single authority any party could use to impersonate another — trust stays federated, not funneled.
# each party keeps its own trust root — no shared root
redoubt-cli connect --party-id party-aOut-of-band fingerprint verification
When a party registers or retrieves a counterparty's CA, the tool surfaces a SHA-256 fingerprint and refuses to imply trust until you confirm it out of band. That closes the key-substitution and man-in-the-middle gap at the exact moment trust is first established.
# confirm the counterparty's identity out of band before trust
redoubt-cli ca register --party-id party-aVerify before you connect
Before exchanging anything, a party runs a verify step that checks the intermediary's integrity against what was registered at enrollment, and exits with an explicit 'do not connect' if a check fails. Verification can be run fail-closed.
# exits non-zero with "DO NOT CONNECT" if a check fails
redoubt-cli verify <host>Network-isolated workloads
The application that processes the data is isolated from the network, so a compromised app has no channel to exfiltrate over — it can't call out on its own.
A witnessed channel, not an opaque pipe
Unlike a blind VPN or L4 tunnel, the witnessed intermediary sits in the middle of every exchange, giving a single point of control for enforcement and audit. Transport is hardened with a post-quantum hybrid key exchange, and parties who want the payload hidden from the intermediary can layer their own end-to-end encryption inside the channel.
# the neutral third party opens the witnessed session
redoubt-cli witness-init --session-name "Data Exchange Q4"Get early access to Redoubt.
Tell us about your workload and we'll get you into the preview.