Three deployment modes

Confium is layered across three deployment modes. The same engine and the same primitives serve all three — what differs is where the integration boundary sits and what shape the trust relationship takes.

At a glance

Mode Name Integration shape When to choose
1 Peer-to-Peer TC Nodes exchange threshold messages directly You control both sides of the channel and want minimal moving parts
2 PKI Drop-in Existing PKCS#11 / OpenSSL / JCE consumer + Confium server You have an existing PKI consumer that needs to migrate to threshold keys
3 Sovereign PKI Custom certificate formats, custom workflows, multi-stakeholder governance You are an institution where no single party can be trusted

Why three modes

Threshold cryptography is a primitive. How you deploy it depends on what you’re plugging it into.

  • If you’re building a new distributed system from scratch, you want peer-to-peer: every node speaks the protocol directly. (Mode 1)
  • If you have an existing PKI consumer (a TLS terminator, a code signer, an HSM-backed signing service), you want a drop-in: the consumer keeps talking PKCS#11 / OpenSSL / JCE; Confium translates each call into a threshold session behind the scenes. (Mode 2)
  • If you’re an institution that needs custom certificate formats, delegation rules, archival cadence, or quorum composition — the kind of thing a conventional CA can’t represent — you want Mode 3.

The three modes are not mutually exclusive. A single deployment may use Mode 2 internally (to migrate an existing code signer) and Mode 3 externally (to issue certificates that downstream verifiers trust).

What’s common

Regardless of mode, every deployment shares:

  • The engine (libconfium) and its plugin loader.
  • The threshold protocols (FROST, CMP20, GG18, threshold ElGamal).
  • The coordinator for async multi-party sessions.
  • The transparency log for tamper-evident audit.
  • The attribute DSL for quorum policies.

What changes is the adapter on top: peer-to-peer network code, a PKCS#11 server, or a Sovereign PKI profile.

Going deeper

See also