Docs

Confium's engine, plugin loader, versioned interfaces, coordinator, and the principles that shape every crate.

You have an HSM today. You want threshold signing without replacing the HSM. This guide walks the migration path — same HSM, same consumers, threshold signing behind it.

You use Sigstore (cosign + Rekor + Fulcio) for container / artifact signing. Here's what Confium adds, what to keep, and how to run both side-by-side during migration.

Mode 1 (Peer-to-Peer TC), Mode 2 (PKI Drop-in), Mode 3 (Sovereign PKI). One engine, three integration shapes.

You use a cloud KMS (AWS KMS, GCP KMS, Azure Key Vault) for signing keys. The KMS holds the key; your app calls the API. Here's how to add threshold control without losing the KMS benefits.

Nodes do threshold cryptography directly. Hours to value. The simplest deployment shape.

Replace single-party keys with threshold keys. Existing PKCS#11 / OpenSSL / JCE consumers keep working unchanged.

Confium supports four deployment modes — Peer-to-Peer TC, PKI Drop-in, Sovereign PKI, and Keyless Threshold.

Custom certificate formats for institutions where no single party can be trusted. Sovereign over formats, delegation, archival, quorum.

The 57-crate Confium Rust workspace, grouped by category. Engine, threshold crypto, PKI, storage, network, Mode 2 adapters, transparency log infrastructure, deployment, benchmarks, Mode 4 keyless, operators, IaC, verification services, fuzzing.

Confium's threat model, trust assumptions, and defense-in-depth layers. What the framework protects against and what it expects of operators.

Migrate from classical to post-quantum signatures via composite signatures. Software upgrade, not HSM replacement. No certificate re-issuance flag day.

RFC 6962 Merkle transparency logs. Inclusion proofs, consistency proofs, witness gossip, OTS anchoring. How split-view attacks are detected.

Quickstart hub for Confium — Ruby, Rust, and WASM install commands and pointers into per-binding docs.

Five-minute quickstarts for Confium in every supported language. Pick yours, copy-paste, verify your first signature. No prior threshold-crypto knowledge required.

Confium vs HSMs, conventional CAs, KMS, Sigstore, and commercial threshold solutions. Where each fits, where each falls short.

FIPS 140 mode, jurisdictional algorithm policies, audit log format, and regulatory mapping to eIDAS, HIPAA, FedRAMP, and Common Criteria.

The confium command-line tool — install, manage, and operate Confium plugins, signers, and the local configuration store.

Common questions about Confium — what it is, how it works, when to use it, and the limits of threshold-native trust infrastructure.

Combining Confium threshold signing with Sigstore-style keyless signing. OIDC-verified ephemeral quorums, Fulcio-style short-lived certs, Rekor-style transparency log. No persistent shares, no key management, no share-rotation ops.

Print the version of the confium CLI and the underlying engine.

Operational gotchas, common errors, and their fixes for Confium deployments and consumers.

Install a Confium plugin from the registry. Currently a stub awaiting the confium-net HTTP-fetching crate.

Run confiumd in production. Docker Compose for single-host evaluation, Helm chart for Kubernetes, Grafana dashboards for observability.

Criterion benchmarks for the confium hot paths. Composite signature verification, transparency log operations. Run locally or in CI.

Remove an installed Confium plugin from the local store.

Update an installed plugin to the latest version. Currently a stub awaiting the confium-net HTTP-fetching crate.

List installed Confium plugins, optionally filtered by interface or algorithm.

Show detailed information about an installed Confium plugin.

Search the Confium plugin registry for available plugins.

Copy-paste code samples for the 10 most common Confium tasks. Each is self-contained, runs against a real coordinator, and links to the relevant docs page for the full story.

Manage the trusted-publisher list — which publishers' plugins the local install will accept.

The Confium Rust API surface — confium-core, confium-composite, confium-transparency, confium-pki, confium-attributes. Types, traits, and entry points for embedded use.

Read and write local Confium configuration.

The @confium/confium-wasm API surface — browser-side verifier for composite signatures, transparency logs, attribute predicates, and PKI. Verifier-only by design: browsers verify, servers sign.

The confiumd daemon — long-running JSON-RPC service for signing sessions, transparency log interaction, and PKI operations.

The plugin author's publishing tool — wraps a plugin artifact, signs the manifest, and prepares it for submission to the Confium registry.

Binaries and adapter libraries shipped by the Confium workspace — beyond the CLI.

PKCS#11 v3.0 server — exposes Confium threshold signing to existing PKCS#11 consumers (OpenSSL ENGINE, Java SunPKCS11, nginx).

OpenSSL 3.0 provider — exposes Confium threshold signing to modern OpenSSL consumers (nginx, curl, custom C).

Java Cryptography Extension provider — exposes Confium threshold signing to Java applications via KeyStore / Cipher / Signature APIs.

TLS 1.3 signature callback — high-value domain protection with threshold signing for handshakes.

NIST MPTS evaluation harness + multi-party threshold simulation runner.

Deep dives into the Mode 2 adapters — PKCS#11, OpenSSL 3.0, JCE, TLS 1.3. How they wire existing consumers into Confium.

PKCS#11 v3.0 adapter — expose Confium as a virtual HSM to OpenSSL, Java, nginx, and custom consumers.

OpenSSL 3.0 provider — expose Confium to modern OpenSSL consumers in-process.

Java Cryptography Extension provider — expose Confium to Java applications via KeyStore / Cipher / Signature APIs.

TLS 1.3 signature callback — threshold signing for high-value domain TLS handshakes.