Confium and RNP

Confium and RNP are sibling projects from the same team. They serve complementary roles in applied cryptography — and the recent Ruby binding change that hard-bundles rnp-rs into confium means you can use both from a single install.

What each does

Confium RNP
Focus Threshold cryptography + transparency logs Standard OpenPGP (RFC 9580)
Key model Multi-party — no single party holds the full key Single-party — one private key
Signature type Composite (hybrid classical + post-quantum) Standard OpenPGP signatures
Transparency RFC 6962 Merkle tree + inclusion/consistency proofs None
Deployment Deployment modes (peer-to-peer TC, PKI drop-in, Sovereign PKI) Standard PGP keyring
Used by Institutions, multi-stakeholder signing, regulated PKI Thunderbird, email encryption, package signing

The split is deliberate. Threshold cryptography and standard OpenPGP answer different questions. A single library trying to do both would either skimp on the threshold protocol implementations or skimp on RFC 9580 conformance. Keeping them separate lets each focus on what it’s for.

When to use which

  • Use Confium when you need: multi-stakeholder signing, threshold quorums, transparency logs, post-quantum migration via composite signatures, institutional PKI with custom certificate formats.
  • Use RNP when you need: standard OpenPGP key generation, signing, verification, encryption, armor encode/decode — the full RFC 9580 toolkit.
  • Use both when your application spans both worlds. The most common pattern: an organization that uses standard OpenPGP for person-to-person communication AND threshold signing for institutional decisions. For example, a certificate authority that issues both standard PGP keys (via RNP) and threshold- signed certificates (via Confium).

Language bindings

Both projects ship bindings for the same languages. Same API conventions, same install patterns:

Language Confium RNP
Ruby gem install confium gem install ruby-rnp
Python pip install confium pip install py-rnp
WASM npm install @confium/confium-wasm npm install @rnpgp/rnp
Rust cargo add confium-core cargo add rnp-rs

The Ruby binding of Confium takes this one step further — read on.

Ruby: Confium::OpenPGP

The Confium Ruby gem hard-bundles rnp-rs into its native extension. You don’t need a separate ruby-rnp install for OpenPGP armor encode/decode and basic RFC 9580 operations.

require "confium"

# Threshold signing (Confium)
tree = Confium::Transparency::MerkleTree.new
seq = tree.append(artifact_type: :threshold_signature, artifact_hash: hash)

# Standard OpenPGP armor (RNP, bundled)
armored = Confium::OpenPGP.armor(raw_bytes, Confium::OpenPGP::PUBLIC_KEY)
decoded = Confium::OpenPGP.dearmor(armored)

The extension links librnp at build time and exposes _native_armor / _native_dearmor via the Rust → magnus bridge. The Ruby wrapper in lib/confium/openpgp.rb adds default-arg convenience.

Why hard-bundle?

Three reasons:

  1. Zero-dependency install. gem install confium is the only step. No system OpenPGP library to discover, no ruby-rnp to add to the Gemfile alongside.
  2. Windows support. Building rnp-rs from source on Windows has historically been painful. Vendoring the source via rnp-src means Windows users get a working build without a MinGW / MSVC OpenPGP library on the system.
  3. Version alignment. The Confium extension knows which RNP version it was built against. Hard-bundling eliminates “works on my machine” drift between the confium and ruby-rnp installs.

What’s exposed via Confium::OpenPGP

The Confium::OpenPGP module is intentionally narrow — it’s a convenience for the common case (armor / dearmor), not a full RFC 9580 surface. For the full surface (key generation, signing, verification, encryption, web-of-trust), use ruby-rnp directly. The two coexist in the same process without conflict.

Python and WASM

Python and WASM don’t hard-bundle. Use the standalone packages:

# Python
pip install confium py-rnp

# WASM (browser / Node.js)
npm install @confium/confium-wasm @rnpgp/rnp
  • @confium/confium-wasm — transparency log verification, composite signature verification, attribute predicate evaluation. Verifier-only by design.
  • @rnpgp/rnp — full OpenPGP (RFC 9580) in the browser.

The two packages have no overlapping symbols and no shared state. Load both, use each for what it’s good at.

FAQ

Is Confium replacing RNP?

No. They’re complementary. RNP is the production OpenPGP library that powers Thunderbird’s end-to-end email encryption. Confium is a threshold cryptography framework for multi-stakeholder signing. Same team, different problems.

Will Confium’s threshold signing be added to RNP?

No. RNP is bound to RFC 9580 — a single-key signature standard. Threshold signing is a different cryptographic primitive that produces signatures in a different way. Confium’s composite signatures wrap classical + post-quantum components into a single envelope; they’re not standard OpenPGP signatures.

Can I verify a Confium signature with RNP?

Not directly. Confium composite signatures and OpenPGP signatures are different formats. To verify a Confium signature in a browser, use @confium/confium-wasm. To verify an OpenPGP signature in a browser, use @rnpgp/rnp. Each verifies its own format.

See also