This repository is the authoritative technical specification for the Confium open-source framework for multi-stakeholder threshold cryptography.
It is organized as a collection of focused specification documents. Each spec covers one aspect of how Confium works, with conceptual overview, architectural diagrams (SVG), type definitions, wire formats, behavioral invariants, and references to implementation source.
1. Status
This repository is being generalized from a single 2022 technical report into a multi-spec collection reflecting the current three-mode architecture. The original 2022 report is preserved at report.adoc for historical context.
2. Specification documents
2.1. Architecture overview
-
00 — Framework overview — what Confium is, three-mode architecture
-
01 — Three deployment modes — Mode 1 / Mode 2 / Mode 3 definitions
-
02 — Workspace organization — 43-crate structure, dependencies
2.3. Plugin and primitive contracts
-
20 — Plugin contract —
cfmp_*FFI surface -
21 — Interface registry — OCP via
register_interface! -
22 — Threshold session lifecycle — DKG, sign, reshare, refresh
-
23 — Async session coordinator — distributed-signer workflow
-
24 — Share re-sharing — committee evolution, public-key preservation
-
25 — Threshold encryption — KEM, AEAD, hybrid pattern
2.5. Operational specifications
-
40 — Deployment manifest — TOML schema for Mode 2/3
-
41 — Identity and hardware — actor model, PKCS#11/TPM/OpenPGP card
-
42 — Transparency log — Merkle tree + RFC 6962 inclusion proofs
2.6. Algorithm specifications
-
50 — FROST Ed25519 — shipped
-
51 — FROST P-256 — real Shamir+Lagrange+ECDSA
-
57 — Threshold ML-KEM (FIPS 203) — research
-
58 — Threshold ML-DSA-65 (FIPS 204) — research
-
59 — Threshold BFV FHE — research
-
60 — Threshold ring signatures — research
3. Diagrams
Each spec includes architectural diagrams in SVG. Source diagrams live
in images/ (currently confium-arch.svg, confium-tests.svg,
rnp-crypto-arch.svg from the 2022 report).
New diagrams being added in this multi-spec rollout:
-
three-mode-architecture.svg— high-level Mode 1/2/3 layout -
cnml-tier-hierarchy.svg— BIML → IA → TL/Mfr-Model → Instance -
async-session-lifecycle.svg— coordinator state machine -
share-reshare.svg— committee evolution protocol -
transparency-log.svg— Merkle tree + OTS anchoring -
mode2-pkcs11-dispatch.svg— PKCS#11 server flow -
plugin-registry.svg—register_interface!link-time registration
4. Cross-references
Each spec cross-references:
-
Implementation source:
https://github.com/confium/confium/tree/main/crates/<crate-name>; -
Engineering roadmap doc:
https://github.com/confium/confium/blob/main/TODO.roadmap/<n>-<name>.md -
API documentation:
https://docs.rs/<crate-name>;
5. Anti-goals
-
Not duplicating API reference (RustDoc is canonical)
-
Not duplicating engineering roadmap (
TODO.roadmap/in main repo is canonical) -
Not duplicating operational runbooks (operator-managed
infrastructure/is canonical)
This repo is for what Confium is (specifications) and how it works (diagrams + behavioral invariants), not for how to deploy it or what’s next on the roadmap.
7. Authoritative source
The canonical version of this repository is
github.com/confium/confium-report.