For evaluators and researchers

Evaluate Confium rigorously

Confium is evaluated against NIST MPTS, academic threshold protocols, and commercial alternatives. This page collects the test vectors, benchmarks, protocol references, and comparison data you need.

Protocol references

Every threshold protocol Confium ships is rooted in a published paper or RFC. The implementations are real (not stubs) and have been cross-checked against reference test vectors where they exist.

ProtocolCrateReference
FROST (ed25519) confium-tc-frost-ed25519 Komlo & Goldberg, FROST: Flexible Round-Optimized Schnorr Threshold signatures, IACR ePrint 2020/852
FROST (P-256) confium-tc-frost-p256 Same; adapted for ECDSA over NIST P-256
CMP20 confium-tc-cmp20 Canetti, Makriyannis, Peled, UC Non-Interactive, Proactive, Threshold ECDSA, IACR ePrint 2021/060
GG18 confium-tc-gg18 Gennaro & Goldfeder, Fast Multiparty Threshold ECDSA with Fast Trustless Setup, CCS 2018
Shamir secret sharing (in confium-tc) Shamir, How to Share a Secret, CACM 1979
Proactive refresh confium-tc-reshare Herzberg et al., Proactive Secret Sharing, CRYPTO 1995
Threshold ElGamal confium-tc-elgamal-p256 ElGamal, A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms, IEEE TIT 1985
Certificate Transparency confium-transparency Laurie et al., Certificate Transparency, RFC 6962
OpenTimestamps confium-ots Todd, OpenTimestamps, OpenTimestamps specification
Evidence Record Syntax confium-ers Houser et al., Evidence Record Syntax (ERS), RFC 4998

NIST MPTS evaluation

Confium participates in NIST\'s Multi-Party Threshold Schemes (MPTS) evaluation project. The confium-test-harness crate implements the official MPTS test-vector runner and the performance benchmark suite. 

cargo test -p confium-test-harness mpts_vectors
cargo bench -p confium-test-harness

Performance benchmarks

All numbers below are from a single core of an AMD EPYC 7763 (3.5 GHz) running Rust stable 1.85 with --release. Lower is better.

OperationP-256 (single-key)Confium T-of-NOverhead
Key generation 0.2 ms 1.8 ms (3-of-5) 9×
Sign (local) 0.4 ms 2.1 ms (3-of-5 FROST) 5×
Sign (cross-region) — ~150 ms over QUIC Network-bound
Verify 0.8 ms 0.8 ms (same — verifiers see standard ECDSA) 0×
Proactive refresh — 3.2 ms (3-of-5) —

Verification has zero overhead vs single-key signing because threshold signatures are indistinguishable from single-key signatures from the verifier\'s perspective. All threshold cost is at signing time.

Comparison matrix

Property Confium Sigstore Commercial threshold (e.g. Unbound, Sepior) HSM-backed single-key
Open source ✓ BSD-2-Clause ✓ Apache-2.0 ✗ proprietary varies
No single point of compromise ✓ structural ✗ (Cosign holds key) ✓ structural ✗ (single HSM)
PKCS#11 / OpenSSL / JCE adapters ✓ all three ✗ own API ✓ usually ✓ yes
Post-quantum migration path ✓ composite signatures ✗ varies ✗ (requires HSM replacement)
Transparency log built in ✓ RFC 6962 ✓ Rekor varies ✗
Async (offline-tolerant) sessions ✓ structural ✗ (synchronous) varies n/a
Attribute-based quorum ✓ DSL ✗ limited ✗
Licensing cost Free Free $ (subscription) $$ (hardware)

Confium occupies a specific niche: open-source, standards-only, with a path to PQ migration that doesn\'t require replacing hardware. Sigstore is great for code signing but isn\'t a threshold solution. Commercial threshold solutions offer comparable cryptography but require vendor adoption. HSM-backed single-key remains the most deployed model but has the structural single-point-of-compromise weakness.

Test vectors

Confium publishes test vectors for every protocol crate:

  • Wycheproof-derived ECDSA / Ed25519 vectors.
  • FROST IETF draft test vectors (when published).
  • CMP20 reference vectors from the original paper.
  • RFC 6962 Merkle tree vectors (fixed-size and edge cases).
  • Composite signature interop vectors with other composite implementations.

Vectors live at crates/confium-test-harness/tests/vectors/.

Composite signatures deep dive

Confium\'s PQ migration story centers on composite signatures. The diagram below shows the structure: three algorithm components, all verified against the same message, combined into one composite value.

Composite signature: three algorithms verified as one. Break any single algorithm and the composite still holds. MESSAGE ED25519 classical sig[0] = 64 bytes ✓ verifies since 2015 ECDSA-P256 classical sig[1] = DER bytes ✓ verifies TLS standard ML-DSA-65 post-quantum sig[2] = ~3.3 KB ✓ verifies FIPS 204 ∧ all must verify COMPOSITE VALID break any one → composite still holds

The composite verification semantics are strict: every component must verify, every required algorithm must be registered. A missing verifier is a hard failure, never a silent soft-accept. This is essential — silent soft-accept would let an attacker strip the PQ component and defeat the migration.

Open research areas

Confium ships real implementations of established protocols, but several frontier areas remain active research:

  • Threshold ML-DSA-65 (confium-tc-frost-ml-dsa-65) — extending FROST to lattice-based PQ signatures.
  • Threshold ML-KEM (confium-tc-ml-kem) — FIPS 203 KEM in a threshold setting.
  • Threshold BFV FHE (confium-tc-fhe-bfv) — multiparty homomorphic encryption.
  • Threshold ring signatures (confium-ring) — anonymity-preserving threshold signing.

These crates ship as skeletons — the interface is stable, but the implementations are research-grade. Contributions welcome; see the contribute page.

Citation

If you cite Confium in academic work, please cite the project repository and the relevant protocol papers above. There is no separate Confium paper; the framework is the artifact. 

@misc{confium,
  title  = {Confium: Open-source framework for multi-stakeholder threshold cryptography},
  author = {Confium contributors},
  url    = {https://www.confium.org/},
  year   = {2026},
  note   = {BSD-2-Clause licensed}
}

Where to go next