← All Products

Confium Threshold

Eliminate single points of failure in your signing infrastructure.

Security EngineersDevSecOpsPlatform Engineers

Get a 2-of-3 threshold ECDSA signature in 5 minutes. No HSM, no K8s, just cargo and a terminal.

Time: ~5 minutes  ·  Prerequisites: Rust 1.85+ (or Docker / language SDK per the tabs below)

  1. 1

    Install Rust + cargo

    Rust 1.85+ (edition 2024). Install via rustup.

    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
rustup default stable
rustc --version  # need 1.85+
  2. 2

    Install confium-cli

    cargo install --locked confium-cli

    cargo install --locked confium-cli
confium --version
  3. 3

    Run a 3-party DKG

    Generate shares for a 2-of-3 threshold key.

    confium threshold dkg \
  --parties 3 \
  --threshold 2 \
  --scheme cmp20 \
  --out-dir ./shares/
ls ./shares/
# party1.json  party2.json  party3.json  public.json
  4. 4

    Sign a message

    Combine 2 shares to produce an ECDSA signature.

    confium threshold sign \
  --shares ./shares/party1.json ./shares/party2.json \
  --message "hello, threshold world" \
  --out ./signature.der
# Combined signature from 2 shares; party3 was offline.
  5. 5

    Verify

    Confirm the signature with the public key.

    confium verify ecdsa-p256 \
  --message "hello, threshold world" \
  --signature ./signature.der \
  --public-key ./shares/public.json
# → valid

What just happened: you ran a 3-party distributed key generation (DKG), combined 2 of 3 shares to sign a message (the third party was unnecessary), and verified the result against the joint public key. That's the entire threshold-signing primitive.

Next steps