title: Workspace map description: Every Confium Rust crate organized by category with one-line descriptions.

Workspace map

The Confium Rust workspace contains 65 crates organized by concern. This page maps every crate to its category and role. For per-crate deep dives, see the crates subdirectory.

Categories

Category Role
Engine / Core Host library, plugin loader, public API, CLI, daemon.
Threshold cryptography Threshold signing protocols (CMP20, GG18, FROST) and the coordinator.
Threshold encryption Threshold encryption schemes (ElGamal, ECIES, ML-KEM, FHE).
Shared crypto primitives VSS, Paillier, Schnorr, NIZK — the building blocks above the scheme layer.
Privacy primitives PSI, MPC, ring signatures, VRF, VDF, differential privacy.
PKI / Certificates X.509, CMS, XMLDSig, composite signatures, attribute predicates.
Storage / Hardware Compartmentalized backends: PKCS#11, TPM, cloud KMS, OpenPGP card.
Mode 2 / PKI replacement Drop-in adapters for PKCS#11, OpenSSL, JCE, TLS.
Network / Transport TCP, QUIC, WebSocket transports and sandbox runtimes.
Deployment / Identity Actor identity and deployment manifest TOML validation.
Transparency / Archival Merkle transparency log + OTS anchoring + ERS archival.
Product facades Single-entry-point crates per product (Threshold, Keyless, Verify).
Deployable services Production server binaries (signerd, log-server, verify-server, operator).
Tooling OIDC, Node binding, fuzz targets, benchmarks, WASM verifier.
Patterns Threshold key escrow + threshold revocation.
Language bindings Python PyO3 native extension.

Engine / Core

Crate Role
confium-core Engine: plugin loader, registry, and FFI entry points for the Confium framework.
confium-api Public Rust API and plugin SDK for the Confium threshold cryptography framework.
confium-macros Proc-macros for Confium plugin authors.
confium-cli Command-line interface for the Confium threshold cryptography framework.
confium-daemon JSON-RPC daemon for the Confium threshold cryptography framework.
confium-mock-plugin Reference mock plugin for testing Confium plugin loading.
confium-publish Author tool for publishing Confium plugins to the registry.
confium-test-harness NIST MPTS evaluation harness for Confium threshold schemes.
confium-examples Runnable example binaries demonstrating Confium threshold cryptography.
confium-registry Client for the Confium static-site plugin catalog.

Threshold cryptography

Crate Role
confium-tc Threshold cryptography primitives: session, coordinator, reshare, KEM, TCP server.
confium-tc-core Core threshold cryptography session primitives — the minimal interface for scheme plugins.
confium-tc-cmp20 CMP20 threshold ECDSA over P-256 for Confium.
confium-tc-gg18 GG18 threshold ECDSA for Confium.
confium-tc-frost-p256 FROST threshold signature with real Shamir and ECDSA over P-256.
confium-tc-frost-ed25519 FROST threshold signature over Ed25519 for Confium.
confium-tc-bls Threshold BLS signature for cross-organization aggregation in Confium.
confium-tc-frost-ml-dsa-65 Threshold FROST over ML-DSA-65 (FIPS 204) for Confium.
confium-tc-keys Key lifecycle, HSM protection, production hardening for threshold keys.
confium-coordinator Distributed threshold signing coordinator: session orchestration, rate limiting, policy, metrics.

Threshold encryption

Crate Role
confium-tc-elgamal-p256 Threshold ElGamal encryption over P-256 for Confium.
confium-tc-ecies-p256 Threshold ECIES with ECDH and AES-256-GCM over P-256 for Confium.
confium-tc-ml-kem Threshold ML-KEM (FIPS 203) for post-quantum encryption in Confium.
confium-tc-fhe-bfv Threshold BFV fully homomorphic encryption for Confium.

Shared crypto primitives

Crate Role
confium-crypto-vss Verifiable secret sharing, Paillier, Schnorr proofs, and NIZK primitives.
confium-crypto-zk Zero-knowledge proof systems: set membership, signature possession, accumulators.

Privacy primitives

Crate Role
confium-privacy Privacy-preserving crypto: MPC, PSI, PIR, differential privacy, ring signatures.
confium-ring Threshold ring signatures for anonymous signing in Confium.

PKI / Certificates

Crate Role
confium-pki X.509 cert, scoped delegation, CMS, and XMLDSig for Confium.
confium-pki-tc Threshold PKI integration: CT log, OCSP, ACME, attribute-based encryption.
confium-composite Composite multi-algorithm signature aggregation for PQ migration in Confium.
confium-attributes Attribute-based threshold party selection with predicate DSL for Confium.

Storage / Hardware

Crate Role
confium-store Compartmentalized key and secret persistence for Confium.
confium-store-pkcs11 PKCS#11 v3.0 wrapping backend for Confium key storage.
confium-store-tpm TPM 2.0 sealed storage backend for Confium.
confium-store-cloud AWS, GCP, and Azure cloud KMS backend: real clients (lazy credential chains), ListKeys enumeration (aws-kms), and the sign-with-handle contract over each provider’s Sign API.
confium-store-openpgp-card OpenPGP card backend (YubiKey, Nitrokey) for Confium store.

Mode 2 / PKI replacement

Crate Role
confium-pkcs11-server PKCS#11 v3.0 server dispatching to Confium threshold protocol.
confium-openssl-provider OpenSSL 3.0 provider using Confium for threshold signing.
confium-tls-signer TLS 1.3 signature callback satisfying via Confium threshold.
confium-jce-provider Java Cryptography Extension provider for Confium threshold signing.

Network / Transport

Crate Role
confium-net Network transport abstraction for Confium multi-party protocols.
confium-net-tcp TCP transport for Confium multi-party threshold protocols.
confium-net-quic QUIC transport for Confium multi-party threshold protocols.
confium-net-ws WebSocket transport for Confium multi-party threshold protocols.
confium-sandbox-wasm WASM sandbox for browser-based Confium director signing.
confium-sandbox-process Out-of-process sandbox for isolating Confium plugin execution.

Deployment / Identity

Crate Role
confium-deployment Deployment manifest schema and actor identity management for Confium.

Transparency / Archival

Crate Role
confium-transparency Append-only Merkle tree transparency log with OTS anchoring and ERS archival.

Product facades

Crate Role
confium-threshold Confium Threshold product facade — T-of-N distributed signing (CMP20, GG18, FROST).
confium-keyless Confium Keyless product facade — OIDC-based keyless threshold signing.
confium-verify Confium Verify product facade — multi-language verification of signatures, proofs, certs.

Deployable services

Crate Role
confium-signerd Distributed threshold signing daemon — connects to coordinator and responds to signing requests.
confium-log-server Public transparency log server for Confium (log.confium.org reference implementation).
confium-log-monitor Third-party monitor for Confium transparency logs — detects fork attempts and consistency violations.
confium-verify-server HTTP service for verifying threshold signatures and transparency proofs.
confium-operator Kubernetes operator for Confium threshold signing ceremonies.

Tooling

Crate Role
confium-oidc OIDC token verifier for Confium’s keyless threshold mode (Mode 4).
confium-node Node.js bindings for the Confium threshold cryptography framework.
confium-fuzz Fuzzing targets for confium security-critical surfaces.
confium-observability Enterprise observability: structured logging, trace correlation, metrics, syslog.
confium-benchmarks criterion benches for the confium hot paths.
confium-wasm Browser/Node.js verifier package for Confium — composite signatures, transparency proofs, certificate validation. WASM-bindgen surface; verifier-only by design.

Patterns

Crate Role
confium-patterns Threshold crypto deployment patterns: key escrow and revocation service.

Language bindings

Crate Role
confium-python Python bindings for the Confium threshold cryptography framework.

Choosing a crate

If you’re not sure where to start: