Confium Specs by Product

Confium is organized into 6 products. This index lists every spec under its primary product. Mode 1/2/3 terminology is deprecated in favor of product names; specs that still reference modes are retained for historical context.

Threshold

T-of-N distributed signing — CMP20, GG18, FROST, MuSig, BLS.

• Threshold Session — session lifecycle, party registry, message dispatch
• Async Coordinator — multi-round orchestration service
• Share & Reshare — Herzberg refresh, T/N changes without re-keying
• FROST over P-256 — 2-round threshold ECDSA with Feldman VSS
• Threshold ElGamal over P-256 — threshold encryption
• CMP20 Threshold ECDSA (draft) — 3-round ECDSA with Paillier MtA
• GG18 Threshold ECDSA (draft) — 4-round ECDSA (legacy; prefer CMP20)
• FROST over Ed25519 (draft) — 2-round threshold EdDSA

Transparency

RFC 6962 append-only logs with witness gossip, OTS anchoring, ERS archival.

• Transparency Log — RFC 6962 inclusion/consistency proofs
• Witness Gossip (draft) — distributing log roots to witnesses
• OTS Bitcoin Anchoring (draft) — anchoring tree heads to Bitcoin
• ERS Long-Term Archival (draft) — Evidence Record Syntax for multi-decade archival

PKI

Threshold-backed certificate authority, OCSP/CRL, ACME, composite signatures.

• CNML Deployment — institutional CNML flagship Mode 3 deployment
• Threshold CA Lifecycle (draft) — issue, revoke, CRL from threshold keys
• Composite Signatures (draft) — PQ migration via multi-alg composites
• FIPS 140-3 Positioning — claims policy, algorithm inventory, migration lanes
• PKCS#11 Server (draft) — drop-in HSM replacement via PKCS#11 v3.0

Keyless

OIDC-based keyless signing with short-lived certificates.

• OIDC Binding (draft) — binding short-lived certs to OIDC identities
• Keyless Signing Flow (draft) — end-to-end ceremony
• Short-Lived Certificate Format (draft) — cert shape and anchoring

Privacy

Privacy-preserving cryptographic primitives.

• Private Set Intersection (draft) — ECDH-PSI and other variants
• MPC (SPDZ) (draft) — secure multi-party computation
• Differential Privacy (draft) — zCDP and epsilon-delta budgets
• Ring Signatures (draft) — spontaneous anonymous group signatures

Verify

Verification surface across languages and environments.

• WASM Verifier (draft) — @confium/confium-wasm browser/Node/edge
• HTTP Verification Service (draft) — confium-verify-server
• Bindings Parity Matrix (draft) — feature coverage per language

Cross-cutting

• Framework Overview — 30,000-foot view of Confium
• Workspace Organization — the 6 products × 65 crates
• Security Model — threat model, trust boundaries, side channels

Historical (Mode 1/2/3)

Mode-tagged terminology is deprecated; these specs are retained for historical context.

• Three Modes — the original mode 1/2/3 framing
• Mode 1 — Peer-to-peer TC
• Mode 2 — PKI Replacement
• Mode 3 — Certificate PKI

Adding a new spec

1. Pick the next free number in the relevant product range (30s for privacy, 60s for verify, etc.).
2. Copy the structure of an existing spec.
3. Set the :product: attribute in the header.
4. Add a link entry to this index.
5. Set status to :status: draft until reviewed.