Specs
Normative specifications
The authoritative specs live at github.com/confium/specs. This page renders them through the central site for unified navigation and search.
Product index
Architecture
-
Specification 00 — Framework overview
specs/00-framework-overview.adocConfium is an open-source framework for **multi-stakeholder threshold
-
Specification 01 — Three deployment modes
specs/01-three-modes.adocConfium supports three layered deployment modes.
-
Specification 02 — Workspace organization
specs/02-workspace-organization.adocThe `confium/` Rust workspace contains 67 crates organized by concern.
Deployment modes
-
Specification 10 — Mode 1: Peer-to-peer threshold cryptography
specs/10-mode1-peer-tc.adocN nodes on the internet do threshold cryptography directly with each
-
Specification 11 — Mode 2: TC PKI replacement (drop-in)
specs/11-mode2-pki-replacement.adocExisting PKI consumers (web servers, code signers, email signers, VPN
-
Specification 12 — Mode 3: TC Certificate PKI
specs/12-mode3-certificate-pki.adocOrganizations with their own certificate/document formats and workflow
Threshold
-
Specification 22 — Threshold session lifecycle
specs/22-threshold-session.adocA threshold session is the unit of interaction among T-of-N parties
-
Specification 23 — Async session coordinator
specs/23-async-coordinator.adocThe coordinator enables globally distributed threshold signers to
-
Specification 24 — Share re-sharing
specs/24-share-reshare.adocRe-sharing works by Lagrange interpolation.
-
Specification 50 — Compartmentalized key storage backends
specs/50-store-backends.adocConfium Store provides a compartmentalized key-value storage
-
Specification 51 — FROST threshold signature over ECDSA P-256
specs/51-frost-p256.adoc* FROST: draft-irtf-cfrg-frost-13
-
Specification 54 — Threshold ElGamal over P-256
specs/54-elgamal-p256.adocThreshold ElGamal encryption over P-256.
-
Specification 60 — Threshold deployment patterns
specs/60-deployment-patterns.adocConfium Patterns provides reusable threshold-crypto deployment
-
CMP20 Threshold ECDSA
specs/70-cmp20.adocThis spec is a **draft**.
-
GG18 Threshold ECDSA
specs/71-gg18.adoc**Draft.** Reference implementation: `crates/confium-tc-gg18`.
-
FROST over Ed25519
specs/72-frost-ed25519.adoc**Draft.** Reference implementation: `crates/confium-tc-frost-ed25519`.
Transparency
-
Specification 42 — Transparency log (RFC 6962 Merkle tree)
specs/42-transparency-log.adocProve every issued artifact was publicly logged.
-
Witness Gossip Protocol
specs/43-witness-gossip.adoc**Draft.** Reference implementation: `crates/confium-log-server` (gossip module).
-
OTS Bitcoin Anchoring
specs/44-ots-anchoring.adoc**Draft.** Reference implementation: `crates/confium-transparency/src/ots.rs`.
-
ERS Long-Term Archival
specs/45-ers-archival.adoc**Draft.** Reference implementation: `crates/confium-transparency/src/ers.rs`.
PKI
-
Specification 30 — X.509 PKI: certificates, CMS, delegation, XMLDSig
specs/30-x509-pki.adocConfium PKI provides X.509 certificate parsing, CMS SignedData
-
Specification 41 — Attribute-based signing predicates
specs/41-attributes-dsl.adocConfium Attributes provides a predicate DSL for attribute-based
-
Threshold CA Lifecycle
specs/81-threshold-ca.adoc**Draft.** Reference implementation: `crates/confium-pki` + `crates/confium-tc-cmp20` + `crates/confium-pkcs11-server`.
-
Composite Signatures (PQ Migration)
specs/82-composite-signatures.adoc**Draft.** Reference implementation: `crates/confium-composite`.
-
PKCS#11 Server
specs/83-pkcs11-server.adoc**Draft.** Reference implementation: `crates/confium-pkcs11-server`.
-
Specification 94 — FIPS 140-3 positioning
specs/94-fips-140-3.adocHow Confium relates to FIPS 140-3 — what is claimed, what is not, and
Keyless
-
OIDC Binding for Keyless Signing
specs/90-oidc-binding.adoc**Draft.** Reference implementation: `crates/confium-oidc`.
-
Keyless Signing Flow
specs/91-keyless-flow.adoc**Draft.** End-to-end reference implementation: `crates/confium-examples/examples/keyless_github_action.yml`.
-
Short-Lived Certificate Format
specs/92-short-lived-cert.adoc**Draft.** Reference implementation: `crates/confium-oidc` + `crates/confium-pki`.
Privacy
-
Private Set Intersection (PSI)
specs/31-psi.adoc**Draft.** Reference implementation: `crates/confium-privacy/src/psi.rs`.
-
MPC (SPDZ)
specs/32-mpc-spdz.adoc**Draft.** Reference implementation: `crates/confium-privacy/src/mpc.rs`.
-
Differential Privacy
specs/33-differential-privacy.adoc**Draft.** Reference implementation: `crates/confium-privacy/src/dp.rs`.
-
Ring Signatures
specs/34-ring-sigs.adoc**Draft.** Reference implementation: `crates/confium-ring`.
-
Specification 95 — Privacy-preserving operation
specs/95-privacy.adocThe privacy surface of Confium: the primitives that let parties
Verify
-
WASM Verifier
specs/61-wasm-verifier.adoc**Draft.** Reference implementation: `crates/confium-wasm`.
-
HTTP Verification Service
specs/62-http-verify.adoc**Draft.** Reference implementation: `crates/confium-verify-server`.
-
Bindings Parity Matrix
specs/63-bindings-matrix.adoc**Draft.** Authoritative live version: [the parity matrix in the confium repo](https://github.com/confium/confium/blob/main/docs/bindings/parity.mdx).