Components
The Confium repository holds a 66-crate Rust workspace plus a few deliberately non-Rust edges. This page maps every component to its layer and role — the layer model itself is explained in Architecture. For full API details, browse the repository; every crate’s source carries inline rustdoc.
Engine & platform
| Crate | Role |
|---|---|
confium-core |
Engine: plugin loader, registry, and FFI entry points. |
confium-api |
Public Rust API + plugin SDK shared types. |
confium-macros |
Proc-macros for plugin authors. |
confium-mock-plugin |
Reference mock plugin for testing the loader. |
confium-net |
Network transport abstraction for multi-party protocols. |
confium-net-tcp / confium-net-quic / confium-net-ws |
TCP, QUIC, and WebSocket transports. |
confium-store |
Compartmentalized key and secret persistence. |
confium-store-pkcs11 / confium-store-tpm / confium-store-cloud / confium-store-openpgp-card |
PKCS#11, TPM 2.0, cloud KMS, and OpenPGP-card (YubiKey, Nitrokey) backends. confium-store-cloud builds real clients for AWS KMS, Cloud KMS, and Key Vault, lists KMS key IDs (ListKeys), and signs remotely via each provider’s Sign API — the sign-with-handle contract (cfm_keystore_sign). |
confium-sandbox-wasm / confium-sandbox-process |
WASM and out-of-process sandboxes for isolating plugin execution. |
confium-deployment |
Deployment manifest schema and actor identity. |
Foundations — shared crypto (publishable)
| Crate | Role |
|---|---|
confium-crypto-vss |
Verifiable secret sharing, Paillier, Schnorr proofs, NIZK. |
confium-crypto-zk |
Zero-knowledge proofs: set membership, signature possession, accumulators. |
confium-privacy |
MPC, PSI, PIR, differential privacy, ring signatures. |
confium-observability |
Structured logging, trace correlation, metrics, syslog. |
Foundations — schemes and domain crypto
| Crate | Role |
|---|---|
confium-tc |
Threshold primitives facade: session, coordinator, reshare, KEM, TCP server. |
confium-tc-core |
The minimal session interface scheme plugins compile against. |
confium-tc-keys |
Key lifecycle, HSM protection, production hardening. |
confium-tc-frost-ed25519 / confium-tc-frost-p256 / confium-tc-frost-ml-dsa-65 |
FROST threshold signatures over Ed25519, P-256, and ML-DSA-65. |
confium-tc-cmp20 |
CMP20 threshold ECDSA over P-256. |
confium-tc-gg18 |
GG18 threshold ECDSA. |
confium-tc-bls |
Threshold BLS for cross-organization aggregation. |
confium-tc-elgamal-p256 / confium-tc-ecies-p256 / confium-tc-ml-kem / confium-tc-fhe-bfv |
Threshold encryption: ElGamal, ECIES, ML-KEM (FIPS 203), BFV FHE. |
confium-composite |
Composite multi-algorithm signatures for post-quantum migration. |
confium-attributes |
Attribute-based party selection with a predicate DSL. |
confium-pki |
X.509 certs, scoped delegation, CMS, XMLDSig. |
confium-pki-tc |
Threshold PKI: CT log, OCSP, ACME, attribute-based encryption. |
confium-transparency |
Append-only Merkle transparency log, OTS anchoring, ERS archival. |
confium-patterns |
Deployment patterns: threshold key escrow and revocation. |
confium-ring |
Threshold ring signatures for anonymous signing. |
confium-signatif |
SIGNATIF framework layer: trust graph, co-signed artifacts, verification pipeline, coverage reports. |
Services
| Crate | Role |
|---|---|
confium-coordinator |
Distributed signing coordinator: session orchestration, rate limiting, policy, metrics. |
confium-signerd |
Signer daemon — connects to the coordinator, answers signing requests. |
confium-log-server |
Public transparency-log server (the log.confium.org reference). |
confium-log-edge |
Cloudflare Worker ingest edge for the public log (TypeScript). |
confium-log-monitor |
Third-party monitor — detects log forks and consistency violations. |
confium-verify-server |
HTTP service verifying threshold signatures and transparency proofs. |
confium-registry |
Client for the static-site plugin catalog. |
confium-oidc |
OIDC token verifier for keyless identity-bound ceremonies. |
confium-keyless |
Keyless product facade — OIDC-based keyless threshold signing. |
confium-operator |
Kubernetes operator for signing ceremonies. |
Products
| Crate | Role |
|---|---|
confium-threshold |
Threshold product facade — T-of-N distributed signing. |
confium-verify |
Verify product facade — multi-language verification. |
confium-keyless |
Keyless product facade (listed under services above for its OIDC wiring). |
Transparency, PKI, and Privacy are served by their foundation
crates (confium-transparency, confium-pki, confium-privacy)
directly.
Surfaces — CLIs, daemons, bindings, adapters
| Component | Role |
|---|---|
confium-cli |
The confium end-user command. |
confium-daemon |
JSON-RPC daemon over Unix socket/TCP. |
confium-python |
Python bindings (PyO3; standalone build). |
confium-node |
Node.js bindings. |
confium-wasm |
Browser/Node.js verifier package — verifier-only by design. |
confium-go |
Go bindings via cgo (Go source package). |
confium-terraform-provider |
Terraform provider (Go). |
confium-ruby |
Ruby gem — sibling repository. |
confium-pkcs11-server |
PKCS#11 v3.0 server dispatching to threshold protocols. |
confium-openssl-provider |
OpenSSL 3.0 provider for threshold signing. |
confium-jce-provider |
Java Cryptography Extension provider. |
confium-tls-signer |
TLS 1.3 signature callback satisfied by a quorum. |
Quality & tooling
| Crate | Role |
|---|---|
confium-test-harness |
NIST MPTS evaluation harness. |
confium-benchmarks |
Criterion benches for hot paths. |
confium-fuzz |
Fuzzing targets for security-critical surfaces. |
confium-it |
Cross-crate integration tests — unpublished by design. |
confium-examples |
Runnable example binaries. |
confium-publish |
Author tool for publishing plugins to the registry. |