Confium Cookbook

Practical recipes. Each recipe is focused, copy-paste-runnable, and answers a specific question. If you want a narrative tour instead, see Getting Started.

Threshold

• Threshold-sign-with-CMP20 — 2-of-3 sign ceremony
• Refresh shares without re-keying — Herzberg proactive security
• Backup and restore shares — disaster recovery

Transparency

• Stand up a local transparency log — 5-minute setup
• Anchor tree heads to Bitcoin via OTS
• Run a third-party witness

PKI

• Composite sign with classical + PQ
• Drop-in PKCS#11 HSM replacement

Keyless

• Sign a GitHub release keylessly

Privacy

• Two-party PSI
• DP aggregation on user telemetry

Verify

• Verify in the browser via WASM
• Deploy a public HTTP verify endpoint

Operations

• Deploy signerd on Kubernetes
• Monitor Confium with Prometheus

Contribute a recipe

Open a PR adding docs/cookbook/\{slug\}.mdx. Each recipe should:

1. State the problem in one sentence
2. Show the minimum reproducible setup
3. Show the solution with copy-paste-runnable code
4. Note edge cases or pitfalls
5. Link to deeper docs (specs, API reference)

See CONTRIBUTING.md for the contribution process.

Implementation status

Some recipes reference CLI commands or example files that are in progress: the underlying crate APIs exist, and the CLI wrappers and example files follow in subsequent releases.

Recipe	CLI commands used	Status
threshold-sign-with-cmp20	threshold dkg, threshold sign	✅ All commands ship
local-transparency-log	transparency append, transparency prove, transparency verify	✅ All commands ship
two-party-psi	privacy psi	✅ Ships
dp-aggregation	privacy dp	✅ Ships
verify-in-browser	WASM @confium/confium-wasm	✅ Ships
keyless-github-release	uses: confium/action@v1	🚧 Action repo pending
refresh-shares	threshold refresh	✅ Ships
public-verify-endpoint	docker pull ... verify-server	✅ Image ships (private until made public)
prometheus-monitoring	/metrics on services	✅ Metrics endpoints exist
backup-shares	threshold share-export, share-import	⚠️ Rust API exists; CLI wrappers pending
deploy-signerd-k8s	K8s manifests	✅ Manifests ship
run-a-witness	docker pull ... log-monitor	✅ Image ships (private until made public)
ots-bitcoin-anchoring	transparency ots, transparency head	⚠️ Rust API exists; CLI wrappers pending
pkcs11-hsm-replacement	confium-pkcs11-server	⚠️ Server binary exists; PKCS#11 .so module pending
composite-sign-pq-migration	pki composite-sign, verify composite	✅ Commands ship (Ed25519+P256 only; PQ pending)