Confium for Rust Developers

Confium is Rust-native. Every crate ships on crates.io; rustdoc at docs.rs/confium-\{crate\}.

Install

# Cargo.toml — pick the product facades you need
[dependencies]
confium-threshold = { version = "0.4", features = ["cmp20", "frost-p256"] }
confium-verify    = "0.4"
confium-pki       = { version = "0.4", features = ["full"] }
confium-transparency = "0.4"
confium-privacy   = "0.4"

Hello, threshold

use confium_threshold::cmp20;

// 2-of-3 DKG
let kg = cmp20::keygen(2, 3).expect("DKG");

// Sign with all 3 shares (the threshold is 2, so any 2 would suffice)
let sig = cmp20::sign(&kg.shares, 2, b"hello, threshold world").expect("sign");

// The signature is a standard 64-byte ECDSA-P256 (r, s) pair.
// Verify it with any standard P-256 verifier (p256 crate, OpenSSL, etc.).
// Confium produces standard ECDSA signatures; there's no Confium-specific verify needed.
//
// Example using the p256 crate directly:
//   let vk = p256::ecdsa::VerifyingKey::from_sec1_bytes(&kg.public_key).unwrap();
//   let sig_obj = p256::ecdsa::Signature::from_slice(&sig).unwrap();
//   vk.verify(&message, &sig_obj).unwrap();

Verify a composite signature

use confium_composite::{CompositeSignature, ed25519_verifier, p256_verifier};

let sig: CompositeSignature = serde_json::from_str(&sig_json)?;
let result = sig.verify(&message, |alg, pk, msg, sig| {
    match alg {
        "Ed25519" => ed25519_verifier(alg, pk, msg, sig),
        "ECDSA-P256" => p256_verifier(alg, pk, msg, sig),
        _ => Err(format!("unknown algorithm: \{alg\}")),
    }
})?;
println!("valid: {}, components checked: {}", result.all_verified(), result.per_component.len());

Append to a transparency log

use confium_transparency::{MerkleTree, entry::{ArtifactType, MerkleEntry}};

let mut tree = MerkleTree::new();
let hash = [0u8; 32]; // sha256 of your artifact
let entry = MerkleEntry::new(0, ArtifactType::CertificateIssuance, hash);
let seq = tree.append(entry);
let root = tree.root();

let proof = tree.inclusion_proof(seq)?;

Parse + verify an X.509 cert

use confium_pki::Certificate;

let cert = Certificate::from_der(&der_bytes)?;
// Subject / issuer live on the inner x509-cert type:
println!("Subject: {}", cert.as_inner().subject);
println!("Not after: {}", cert.not_after());

// Verify chain
use confium_pki::path::{CertPath, verify_path_signatures};
let path = CertPath { leaf: &cert, intermediates: &[], root: &anchor };
// The verifier receives (issuer_pubkey_bytes, signed_cert_der) per
// link and returns Ok(()) if the signature is valid.
let result = verify_path_signatures(&path, |_issuer_pk, _signed_der| {
    // Dispatch on algorithm; return Ok if sig verifies.
    Ok(())
});

Apply differential privacy

use confium_privacy::privacy_and_dist_patterns::{dp_query, gaussian_noise};

let true_value = 1234.0;
let sensitivity = 1.0;
let epsilon = 0.5;

let perturbed = dp_query(true_value, sensitivity, epsilon);
println!("publish: \{perturbed\}");

Idiomatic Rust patterns

Error handling

Every Confium crate uses thiserror (newer) or snafu 0.8 (legacy). Match on the error enum:

use confium_pki::CertError;

match Certificate::from_der(&bytes) {
    Ok(cert) => { /* ... */ },
    Err(CertError::Parse(e)) => eprintln!("parse error: \{e\}"),
    Err(CertError::InvalidSignature) => eprintln!("bad signature"),
    Err(e) => eprintln!("other: {e:?}"),
}

Feature flags

Each crate exposes its surface behind feature flags. Default features are conservative; opt in to more if needed:

confium-threshold = { version = "0.4", default-features = false, features = ["cmp20"] }
confium-pki = { version = "0.4", features = ["parsing", "cms"] }

Async

Threshold signing sessions are inherently async (multi-party). Use the coordinator’s async API:

use confium_coordinator::Coordinator;

let coordinator = Coordinator::connect("https://coordinator:7000").await?;
let session = coordinator.start_dkg("CMP20-ECDSA-P256", 2, 3).await?;
let kg = session.wait_for_completion().await?;

WASM target

confium-wasm is verifier-only by design. For WASI hosts (Cloudflare Workers, edge), enable the sign feature:

rustup target add wasm32-wasip1
cargo build --target wasm32-wasip1 --features sign --release

Rust reference docs

See also