Specification 23 — Async session coordinator

Purpose

The coordinator enables globally distributed threshold signers to participate when convenient — no simultaneity required.

Trust model

The coordinator is honest-but-curious:

• Sees commitments and shares (cannot reconstruct secret — threshold property)
• Cannot forge commitments (director identity-key signatures)
• Cannot corrupt aggregation (verifiable)
• Can DoS specific sessions (withhold aggregation)

For high-stakes deployments, multiple coordinators run in parallel; signers submit to all; aggregation requires any to succeed.

Architecture

The coordinator service:

• Accepts commitments and shares from signers
• Buffers them until threshold is met
• Broadcasts aggregated state when ready
• Aggregates final signature when T shares received
• Audit-logs every step

Unlock window

The passphrase unlock persists for a configurable window (default 4 hours).

• Shorter (e.g., 30 min): more secure — compromised laptop has less time
• Longer (e.g., 24 hours): more convenient — director completes both rounds

Per-quorum policy. BIML defaults to 4 hours; IAs may use longer.

Annual ceremony

The annual ceremony is sacred: in-person, network-isolated, ambassador-credential-verified. Operations performed:

• Root DKG (initial keypair generation, one-time)
• Root renewal (new keypair, cross-signed with old, every N years)
• Director rotation (sync re-sharing, in-person verification)
• Quorum policy changes (e.g., changing T from 5-of-7 to 6-of-9)
• Audit review

Everything else runs async via the coordinator.

Implementation source

• Crate: confium-tc (coordinator submodule)
• FFI: cfmc_session_create, cfmc_session_submit_commitment, cfmc_session_submit_share, cfmc_session_aggregate

Transport security

Coordinator sessions run over registry transports addressed by URL:

• tcp://host:port — plain TCP with length-prefix framing. Local development and trusted networks; every session message is still individually signed by the sender’s identity key (spec 22).
• noise://host:port — Noise_XX (Noise_XX_25519_ChaChaPoly_BLAKE2s) over TCP: mutual static-key exchange during the handshake, then encrypted and authenticated frames. URL parameters: ** key=<hex> — provision a stable local static key (32-byte private key, hex). Without it an ephemeral key is generated (trust-on-first-use). ** pinned=<hex> — SHA-256 fingerprint of the expected remote static key; the handshake aborts on mismatch.

The signer daemon selects the transport via coordinator_url; the coordinator serves any scheme linked into the binary via CoordinatorServer::start_url.