Threshold cryptography · Post-quantum ready · Open source
Confium is to threshold cryptography what TLS libraries are to transport security. You bring the algorithms, the quorum policy, the certificate profile — Confium provides the engine, the coordinator, the adapters, and the audit trail.
No single party holds the signing key. A configurable quorum must participate. Every operation anchors into a transparency log. BSD-2-Clause, sponsored by NLnet and NGI Zero PET.
43
Rust crates
725+
Tests passing
3
Deployment modes
10+
Protocol implementations
Three deployment modes
One engine, three integration shapes
The same primitives serve all three. What changes is the integration boundary — peer-to-peer network code, a PKCS#11 adapter, or a full Sovereign PKI profile with custom certificate formats and attribute-based quorum policies.
Custom certificate formats, delegation rules, archival cadence, and quorum composition for institutions where no single party can be trusted. Sovereign PKI deployments include calibration registries, pharma regulator approvals, academic accreditation, and supply-chain provenance.
Read the Mode 3 docsFor you
Find your path
Confium is a heavy system with many audiences. Pick your role below and you land on a page tailored to your concerns — business value, threat model, code examples, deployment runbook, compliance matrix, or evaluation data.
How it works
From key generation to audited signature
A signing operation passes through five stages. The secret is created once, split into N shares, and never reconstructed. Every signing event anchors into a transparency log for audit.
Generate
Distributed key generation ceremony. Secret exists once, then is split.
Distribute
Shares go to N parties. No single party holds the full key.
Sign
T-of-N quorum co-signs without reconstructing the secret.
Refresh
Shares re-randomize periodically. Compromise windows shrink.
Anchor
Event lands in transparency log. Public, auditable, immutable.
What makes Confium different
Six properties no single-key PKI gives you
Conventional PKI assumes a single trusted CA. Every property below is a structural weakness of that model — and a structural property of Confium's threshold-native design.
Software upgrade, not HSM replacement
Migrate to post-quantum signatures without re-issuing every certificate. Add an ML-DSA-65 component alongside Ed25519 via composite signatures; verifiers that haven't upgraded still accept the classical component, verifiers that have already migrated. No flag day, no forklift upgrade, no new hardware.
Catches silent certificate fraud
Every signing operation anchors into an append-only Merkle transparency log implementing RFC 6962. Split-view attacks become detectable via consistency proofs and witness gossip between coordinators. Optional OpenTimestamps anchoring in Bitcoin gives an irrefutable "what head existed at time T" record.
Standards-only — no vendor lock-in
PKCS#11 v3.0, OpenSSL 3.0 provider, JCE provider, CMS (RFC 5652), X.509, RFC 6962 transparency. Confium slots into existing infrastructure; it never asks you to adopt a proprietary protocol or a single-vendor SDK.
Globally distributed signers
The async coordinator handles round-trip latency across continents. Parties don't need to be online simultaneously — sessions complete over hours or days. A director in Tokyo can sign during their workday; a director in New York submits theirs hours later; the coordinator combines when quorum is reached.
Open source, BSD-2-Clause
No per-transaction fees, no proprietary protocol, no CLAU. Funded by the European Commission through NLnet's NGI Zero PET program and by Mozilla MOSS. Project decisions stay with the maintainer collective.
No unsafe code, anywhere
Every crate carries `#![forbid(unsafe_code)]`. FFI is centralized in confium-core and uses edition 2024's #[unsafe(no_mangle)] form. All threshold protocols (FROST, CMP20, GG18) ship real cryptography — not stubs, not placeholders, not unfinished work.
What Confium is not
Three common misclassifications
Not a crypto library
Crypto libraries (ring, rust-crypto) provide primitives. Confium loads those primitives via plugins and orchestrates them across multiple parties. Algorithms are pluggable, not embedded.
Not an HSM
HSMs store keys in tamper-resistant hardware. Confium integrates with HSMs via PKCS#11 / TPM — the threshold protocol runs in software, the secrets stay wherever you put them.
Not just OpenPGP
RNP is one consumer of Confium. The framework speaks every major standard — PKCS#11, OpenSSL 3.0, JCE, CMS, X.509, RFC 6962. OpenPGP is one shape, not the whole story.
Interactive
No single party can sign alone
Threshold cryptography splits the signing key across N parties. Any T of them can produce a valid signature jointly. Fewer than T reveals nothing useful — the math doesn't even let you tell whether you have the right answer.
Drag the sliders below to model any quorum policy. Try T = 2 with only 1 party participating: the playground shows "No signature possible". Reach the threshold and the status flips green.
- → The full secret is never reconstructed on any single machine.
- → Compromising T−1 parties reveals zero information.
- → Policies compose: 5-of-9 directors from 3 distinct regions.
No signers yet — the signature cannot be produced.
Adjust N and T to model any quorum policy — 3-of-5 directors, 5-of-9 from 3 distinct regions, and so on. Confium's attribute-based threshold DSL expresses policies that the coordinator enforces at signing time.
Get started
Install in your language
Three bindings ship today. The Rust workspace is the source of truth; the Ruby gem and WASM verifier package wrap the same engine for different ecosystems. Each gets you to a working Confium consumer in under five minutes.
$ gem install confiumRuby ≥ 3.1 + Rust stable for the native extension.
Five-minute path
Verify a signature, end to end
- 1.
gem install confium— installs the gem and builds the native extension. - 2. Require and parse a certificate:
Confium::PKI::Certificate.from_pem(...) - 3. Validate the chain via
PathValidator. - 4. Verify a composite signature with the per-algorithm callbacks.
- 5. Anchor the verification event in a transparency log.
Reference deployments
Where Sovereign PKI is the right shape
Institutional certificate infrastructure where no single party can be trusted. These are six scenarios where Mode 3 is already the natural fit — not an exhaustive list.
Calibration registries
BIPM-style metrology chains where measurements must be traceable to a sovereign reference.
Pharma regulator approvals
Multi-jurisdiction regulatory sign-off on clinical trial data and drug approvals.
Academic accreditation
Cross-institutional degree and credential verification without a single trusted authority.
Supply-chain provenance
Manufacturing step attestation anchored in a public transparency log.
Treaty organizations
Multi-state cooperative instruments requiring concurrent sovereign approval.
Certified instruments registry
A reference Mode 3 deployment among many others.
From the blog
Recent writing
Start building with Confium today
Install in your language of choice, verify your first signature in five minutes, and join the open-source threshold-trust collective.
BSD-2-Clause · No licensing fees · Sponsored by NLnet + Mozilla MOSS
Sponsored by
Funded by the European Commission
through NGI Zero PET
Confium is developed in the open with the support of the NGI Zero PET program — a European Commission initiative administered by NLnet that funds open-source work strengthening the privacy and trust properties of the internet. Additional support from Mozilla MOSS.
