Confium Threshold

Eliminate single points of failure in your signing infrastructure.

Security EngineersDevSecOpsPlatform Engineers

What is Confium Threshold?

Confium Threshold is a production-grade threshold signing platform. It replaces single-key HSMs with T-of-N distributed signing — no single party can sign alone, and compromising any T-1 parties doesn't compromise the key.

Key Features

CMP20 with Paillier MtA

Multi-round orchestration

Rate limiting + policy

HSM share protection

K8s operator

Supported Algorithms

CMP20 — 3-round threshold ECDSA over P-256 with real Paillier MtA
GG18 — 4-round threshold ECDSA over P-256
FROST-P256 — 2-round threshold ECDSA over P-256 (Shamir + Feldman VSS)
FROST-Ed25519 — 2-round threshold EdDSA over Ed25519, drivable per-party (one session per signer process; the share never leaves)
MuSig — 2-round threshold Schnorr signatures

Quick Start

# Install

cargo install confium-cli

# Generate threshold key (2-of-3 CMP20)

confium tc keygen --scheme cmp20 --threshold 2 --party-count 3

# Sign a message

confium tc sign --scheme cmp20 --shares keyset.json --threshold 2 --message "hello"

Who is this for?

Security Engineers

DevSecOps

Platform Engineers

Architecture

The coordinator orchestrates signing sessions across distributed signers. Each signer holds a share of the private key. The coordinator collects commitments, runs the MtA protocol, and aggregates partial signatures into a standard ECDSA signature verifiable with the joint public key.

Coordinator

TCP server with multi-round protocol orchestration, policy enforcement, rate limiting, backpressure, and Prometheus metrics.

Signer Daemon

Standalone binary (confium-signerd) that connects to the coordinator, registers, and responds to signing requests.