Docs

Every shipped feature in Confium — threshold signing, transparency log, keyless mode, security primitives, language bindings, infrastructure, and deployment tiers.

Ten ways to install Confium — Ruby gem, Python wheel, Node package, WASM, Homebrew, Nix, Cargo, Docker, Go, and source.

Quickstart hub for Confium — Ruby, Rust, and WASM install commands and pointers into per-binding docs.

Five-minute quickstarts for Confium in every supported language. Pick yours, copy-paste, verify your first signature. No prior threshold-crypto knowledge required.

Common questions about Confium — what it is, how it works, when to use it, and the limits of threshold-native trust infrastructure.

Confium's 66-crate Rust workspace as a layered graph — engine and plugin contract, shared crypto foundations, six products, services, and the binding surfaces that wrap them.

Every component in the Confium repository — the 66-crate Rust workspace plus the Go, Cloudflare Worker, and sibling-repo edges — one line each, grouped by the architecture layers.

Confium's threat model, trust assumptions, and defense-in-depth layers. What the framework protects against and what it expects of operators.

RFC 6962 Merkle transparency logs. Inclusion proofs, consistency proofs, witness gossip, OTS anchoring. How split-view attacks are detected.

Criterion benchmarks for the confium hot paths. Composite signature verification, transparency log operations. Run locally or in CI.

A free, hosted, Bitcoin-anchored Merkle transparency log for every Confium signature, certificate, and signing ceremony.

You have an HSM today. You want threshold signing without replacing the HSM. This guide walks the migration path — same HSM, same consumers, threshold signing behind it.

You use Sigstore (cosign + Rekor + Fulcio) for container / artifact signing. Here's what Confium adds, what to keep, and how to run both side-by-side during migration.

You use a cloud KMS (AWS KMS, GCP KMS, Azure Key Vault) for signing keys. The KMS holds the key; your app calls the API. Here's how to add threshold control without losing the KMS benefits.

Migrate from classical to post-quantum signatures via composite signatures. Software upgrade, not HSM replacement. No certificate re-issuance flag day.

Confium vs HSMs, conventional CAs, KMS, Sigstore, and commercial threshold solutions. Where each fits, where each falls short.

FIPS 140 mode, jurisdictional algorithm policies, audit log format, and regulatory mapping to eIDAS, HIPAA, FedRAMP, and Common Criteria.

Operational gotchas, common errors, and their fixes for Confium deployments and consumers.

Run confiumd in production. Docker Compose for single-host evaluation, Helm chart for Kubernetes, Grafana dashboards for observability.

The confium command-line tool — install, manage, and operate Confium plugins, signers, and the local configuration store.

Print the version of the confium CLI and the underlying engine.

Install a Confium plugin from the registry. Currently a stub awaiting the confium-net HTTP-fetching crate.

Remove an installed Confium plugin from the local store.

Update an installed plugin to the latest version. Currently a stub awaiting the confium-net HTTP-fetching crate.

List installed Confium plugins, optionally filtered by interface or algorithm.

Show detailed information about an installed Confium plugin.

Search the Confium plugin registry for available plugins.

Copy-paste code samples for the 10 most common Confium tasks. Each is self-contained, runs against a real coordinator, and links to the relevant docs page for the full story.

Manage the trusted-publisher list — which publishers' plugins the local install will accept.

The Confium Rust API surface — confium-core, confium-composite, confium-transparency, confium-pki, confium-attributes. Types, traits, and entry points for embedded use.

Read and write local Confium configuration.

The @confium/confium-wasm API surface — browser-side verifier for composite signatures, transparency logs, attribute predicates, and PKI. Verifier-only by design: browsers verify, servers sign.

The confiumd daemon — long-running JSON-RPC service for signing sessions, transparency log interaction, and PKI operations.

The plugin author's publishing tool — wraps a plugin artifact, signs the manifest, and prepares it for submission to the Confium registry.

Binaries and adapter libraries shipped by the Confium workspace — beyond the CLI.

PKCS#11 v3.0 server — exposes Confium threshold signing to existing PKCS#11 consumers (OpenSSL ENGINE, Java SunPKCS11, nginx).

OpenSSL 3.0 provider — exposes Confium threshold signing to modern OpenSSL consumers (nginx, curl, custom C).

Java Cryptography Extension provider — exposes Confium threshold signing to Java applications via KeyStore / Cipher / Signature APIs.

TLS 1.3 signature callback — high-value domain protection with threshold signing for handshakes.

NIST MPTS evaluation harness + multi-party threshold simulation runner.

Deep dives into the PKI adapters — PKCS#11, OpenSSL 3.0, JCE, TLS 1.3. How they wire existing consumers into Confium.

PKCS#11 v3.0 adapter — expose Confium as a virtual HSM to OpenSSL, Java, nginx, and custom consumers.

OpenSSL 3.0 provider — expose Confium to modern OpenSSL consumers in-process.

Java Cryptography Extension provider — expose Confium to Java applications via KeyStore / Cipher / Signature APIs.

TLS 1.3 signature callback — threshold signing for high-value domain TLS handshakes.