Components

The Confium Rust workspace contains 57 crates organized by concern. This page maps every crate to its category and role. For full API details, browse the Confium repository — the relevant crate’s source has inline rustdoc.

Categories

Category Role
Engine / Core The host library, plugin loader, public API, CLI, daemon.
Threshold cryptography Threshold signing protocols (FROST, CMP20, GG18) + coordinator + reshare.
Threshold encryption Threshold encryption schemes (ElGamal, ECIES, ML-KEM, FHE).
PKI / Certificates X.509, CSR, CMS SignedData, XMLDSig, composite signatures, attribute predicates.
Storage / Hardware Compartmentalized backends: PKCS#11, TPM, cloud KMS, OpenPGP card.
Mode 2 / PKI replacement Drop-in adapters for PKCS#11, OpenSSL, JCE, TLS.
Network / Transport TCP, QUIC, WebSocket transports and sandbox runtimes.
Deployment / Identity Actor identity, deployment manifest TOML, container + Helm artifacts.
Transparency / Archival Merkle transparency log + OTS anchoring + ERS archival.
Cross-cutting patterns Threshold key escrow + threshold revocation (Thunderbird-inspired).
Language bindings Python (PyO3), WASM (wasm-bindgen). Ruby is a sibling repo.
Performance / Eval Criterion benchmark suite + NIST MPTS test harness.
Research frontier Threshold ring signatures and other explorations.

Engine / Core

Crate Role
confium-core Engine: plugin loader, registry, FFI entry points (10 interfaces shipped).
confium-api Public Rust API + plugin SDK shared types (OpaqueHandle, OptionMap, PluginMetadata, PluginError).
confium-macros Proc-macros for plugin authors (#[plugin_interface], #[export]).
confium-cli confium end-user command.
confium-daemon JSON-RPC 2.0 daemon over Unix socket / TCP.
confium-mock-plugin Reference mock plugin built entirely with the macros.
confium-publish confium-publish author tool for the plugin registry.
confium-registry Static plugin / publisher / trust-root catalog.
confium-test-harness NIST MPTS evaluation bench.
confium-examples Standalone example binaries.

Threshold cryptography

Crate Role
confium-tc TC session primitives (interface) + coordinator + reshare modules.
confium-tc-frost-ed25519 Real FROST-ed25519 (3-round signing).
confium-tc-frost-p256 Real P-256 Shamir + ECDSA.
confium-tc-cmp20 Real CMP20 threshold ECDSA.
confium-tc-gg18 Real GG18 threshold ECDSA.
confium-tc-bls Threshold BLS skeleton.
confium-tc-frost-ml-dsa-65 Threshold ML-DSA-65 (research).

Threshold encryption

Crate Role
confium-tc-elgamal-p256 Real threshold ElGamal-P256.
confium-tc-ecies-p256 Threshold ECIES skeleton.
confium-tc-ml-kem Threshold ML-KEM (FIPS 203) research.
confium-tc-fhe-bfv Threshold BFV FHE research.

PKI / Certificates

Consolidated into a single crate (confium-pki) covering every PKI concern — X.509, CSR, CMS, XMLDSig, delegation templates, path validation.

Crate Role
confium-pki X.509 cert + CSR + CMS SignedData + XMLDSig + delegation (shipped, real).
confium-composite Composite multi-alg signatures for PQC migration (shipped, real).
confium-attributes Attribute-based threshold predicates + DSL (shipped, real).

Storage / Hardware

Crate Role
confium-store Store pillar with compartmentalized backends.
confium-store-pkcs11 PKCS#11 wrapping backend.
confium-store-tpm TPM 2.0 sealed storage.
confium-store-cloud AWS / GCP / Azure KMS REST.
confium-store-openpgp-card OpenPGP card backend (YubiKey, Nitrokey).

Mode 2 / PKI replacement

Crate Role
confium-pkcs11-server PKCS#11 v3.0 dispatch to threshold protocol.
confium-openssl-provider OpenSSL 3.0 provider.
confium-tls-signer TLS 1.3 signature callback.
confium-jce-provider Java Cryptography Extension provider.

Network / Transport

Crate Role
confium-net Network abstraction.
confium-net-tcp TCP transport.
confium-net-quic QUIC transport.
confium-net-ws WebSocket transport.
confium-sandbox-wasm WASM sandbox for browser director signing.
confium-sandbox-process Out-of-process sandbox.

Deployment / Identity

Crate Role
confium-deployment Actor identity (manufacturer, lab, IA, BIML director) + deployment manifest TOML validation. Backs the Ruby Confium::Identity::Actor and Confium::Config::Manifest classes.

Transparency / Archival

Consolidated into confium-transparency — covers RFC 6962 Merkle trees, OTS anchoring, and ERS long-term archival in one crate.

Crate Role
confium-transparency Append-only Merkle tree (RFC 6962 inclusion + consistency proofs) + OTS anchoring + ERS archival (shipped, real).

Transparency log infrastructure

The reference RFC 6962 log server, the pure-edge variant on Cloudflare, and the third-party monitor that detects forks.

Crate Role
confium-log-server Public transparency log server for Confium (the log.confium.org reference implementation). RFC 6962 add / get-entries / inclusion-proof / consistency-proof / latest-root endpoints.
confium-log-edge Pure-edge variant of the log server — Cloudflare Workers + D1 + Durable Objects + Workers KV. No origin server, no RDS, no regions. ~$220/month at 100M entries/year.
confium-log-monitor Third-party monitor for Confium transparency logs — continuously verifies consistency proofs and detects fork attempts. Deploy in independent failure domains.

Mode 4 — Keyless Threshold

OIDC-verified ephemeral threshold signing (Sigstore-style keyless combined with Confium threshold). See Mode 4 docs.

Crate Role
confium-oidc OIDC token verifier for any standards-compliant issuer (GitHub Actions, Google, Okta, Azure AD, Auth0). Powers Mode 4’s identity-bound ephemeral ceremonies.

Cross-cutting patterns

Crate Role
confium-patterns Threshold key escrow + threshold revocation (Thunderbird-inspired generalizations).

Language bindings

Crate Role
confium-python PyO3 native extension: composite sign+verify, transparency, PKI parse + CMS build, attributes DSL, OTS, ERS, XMLDSig.
confium-node NAPI Node.js binding — server-side signing surface (composite sign + verify, transparency, PKI, threshold sessions).
confium-go Go binding (scaffold). API surface stable; C bridge in progress.
confium-wasm wasm-bindgen verifier package (@confium/confium-wasm on npm). Browser/Node.js verifier only by design.

The Ruby binding lives in a sibling repo (confium-ruby) and wraps the high-level confium-* crates via magnus + rb_sys. It hard-bundles rnp-rs for OpenPGP armor — see Confium and RNP.

Performance / Evaluation

Crate Role
confium-benchmarks Criterion benchmark suite for composite verify + transparency operations. Run locally or in CI to track perf regressions.
confium-test-harness NIST MPTS evaluation bench — the official MPTS test-vector runner.
confium-fuzz Fuzzing targets for security-critical surfaces. Run via cargo fuzz in CI to catch parser + protocol edge cases.

Operations / IaC / Services

Crate Role
confium-operator Kubernetes operator — declarative threshold signing via ConfiumSigningCeremony CRDs. GitOps-friendly.
confium-terraform-provider Terraform provider (Go). Resources: confium_threshold_key, confium_signing_ceremony, confium_transparency_log, confium_share.
confium-signerd Distributed threshold signing daemon — one per signer, connects to coordinator, responds to signing requests.
confium-verify-server HTTP verification service (REST). Stateless, anonymous, public-facing. Drop-in alternative to the JSON-RPC daemon for web verifiers.

Research frontier

Crate Role
confium-ring Threshold ring signatures (skeleton).

Choosing a crate

  • As a library: confium-core + interface crates (composite, pki, attributes, transparency).
  • Plugin author: confium-api + confium-macros.
  • Threshold signing: pick a protocol crate (frost-ed25519, frost-p256, cmp20, gg18) and use the confium-tc coordinator + reshare modules.
  • HSM/PKI replacement: Mode 2 crates — confium-pkcs11-server, confium-openssl-provider, confium-jce-provider.
  • Institutional PKI: Mode 3 — confium-pki, confium-composite, confium-attributes, confium-transparency, confium-deployment.
  • Production deploy: confium-deployment + the Helm chart in deploy/helm/.
  • Benchmark: confium-benchmarks for criterion runs; confium-test-harness for NIST MPTS vectors.

See also