ICMC17 begins with one day of pre-conference workshops, followed by conference plenary keynotes and three days of sessions in nine tracks:

Pre-conference Workshops (W) are presented Tue and the conference begins Wed with a keynote Plenary (P) session Advanced Technology Track (A) High-level technology issues, or special-focus subject matter Certification Programs Track (C) Issues related to the CMVP, government programs and global certification General Technology Track (T) Tools and techniques relating to cryptographic modules Crypto Policy & Ethics (Y) Balancing privacy rights and government access to encrypted communications
Open-Source Cryptography Track (S) Efforts to audit, improve and certify the security of the leading OS crypto projects. User Experience Track (U) CM products, certifications, and vulnerabilities for organizations that rely on crypto security Industry Vertical/Embedded Crypto Track (E) Embedded encryption in specific industry verticals Quantum-Safe Crypto Track (Q) The quantum computing threat and efforts to transition to quantum-safe algorithms Common Criteria Track (R) Issues related to Common Criteria and NIAP-compliant products

 

g

Tuesday, May 16, 2017

  08:00 – 09:00   Registration (Foyer)


  09:00 – 12:30   Pre-Conference Workshops

  Pre-Conference Workshop W01a (Ballroom DE)   Pre-Conference Workshop W01b (Ballroom B)
09:00 Decrypting Crypto: Intro to Cryptography, Steve Weingart, Manager of Public Sector Certifications, Aruba Networks   Intro to FIPS 140, Ray Potter, Founder, SafeLogic; Mark Minnoch, Technical Account Manager, SafeLogic

  12:30 – 13:30   Lunch (Ballroom C)


  13:30 – 17:00   Pre-Conference Workshops

  Pre-Conference Workshop W02a (Ballroom DE)   Pre-Conference Workshop W02b (Ballroom B)
13:30 Intro to Crypto Hardware Attacks, Jasper van Woudenberg, CTO North America, Riscure   FIPS 140-2 Validation Process: Overview and Case Study, Tammy Green, Senior Principal Security Architect, Symantec; Carolyn French, Manager, Cryptographic Module Validation Program, Communications Security Establishment

 

Wednesday, May 17, 2017

  08:00 – 09:00   Registration (Foyer)


  09:00 – 10:20   Plenary Keynote Session (Ballroom ABCDE) Welcome, Ryan Hill, Community Outreach Manager, atsec information security; CMUF Overview, Matt Keller, Vice President, Corsec


09:20


P01a. Know Who Is Touching Your Stuff: Driving Security Across the Value Chain [30MIN] Edna Conway, Chief Security Officer, Global Value Chain, Cisco Systems

 

P01b. Deficient Standards, Complex Certification: Can We Escape the Vicious Circle? [30MIN] Joan Daemen, Principal Cryptographer, STMicroelectronics


  10:20 – 11:00   Networking Break in Exhibits (Hemingway Ballroom)


  11:00 – 12:20   Conference Sessions

  Certification Programs Track
(Ballroom DE)
  General Technology Track
(Ballroom C)
  Industry Vertical/Embedded Crypto (Ballroom B)   Quantum-Safe Crypto Track
(Ballroom A)

11:00


C11a. Keynote: Assurance Architecture Through Testing [40MIN] Michael Cooper, IT Specialist, NIST

 

G11a. Keynote: Building Trust in the Era of Cloud Computing [40MIN] David Gerendas, Group Product Manager, McAfee

 

E11a. Keynote: Applied Cryptography and Practical Example [40MIN] Dr. Najwa Aaraj, Senior Vice President, Special Projects, DarkMatter

 

Q11a. Keynote: Update on ETSI QSC Standards Activities [20MIN] Mark Pecen, CEO, Approach Infinity


11:20

     

Q11b. Update on the Quantum Threat, Mitigation Timelines and Managing Quantum Risk [40MIN] Michele Mosca, Institute for Quantum Computing, University of Waterloo & evolutionQ Inc.


11:40


C11c. Third-Party Security Validation: The Role of FIPS 140-2, Common Criteria, and UC APL in Securing Products [40MIN] John Morris, President, Corsec

 

G11c. The 2017 NIST Transition to Stronger Cryptographic Algorithms [40MIN] Allen Roginsky, Mathematician, NIST

 

E11c. Hardware Security Requirements for Vehicle-to-Everything Communications [40MIN] William Whyte, Chief Scientist Security Innovation

 

12:00

     

Q11d. Quantum Threat…and Quantum Solution [20MIN] Bruno Huttner, Quantum Safe Product Management, ID Quantique SA

  12:20 – 13:20   Lunch in Exhibit Area (Hemingway Ballroom)


  13:20 – 14:20   Conference Sessions

  Certification Programs Track
(Ballroom DE)
  General Technology Track
(Ballroom C)
  Industry Vertical/Embedded Crypto (Ballroom B)   Quantum-Safe Crypto Track
(Ballroom A)

13:20


C12a. Validating Multiple Cryptographic Modules [20MIN] Steve Ratcliffe, TME, Cisco Systems

 

G12a. FIPS as a Vendor—Fitting a Square Peg Into a Round Hole [20MIN] Malcolm Levy, Certification Manager, Check Point Software Technologies

 

E12a. Lessons Learned in IoT Threat Modelling [20MIN] Paul Bottinelli, Security Systems Developer, TrustPoint Innovation Technologies

 

Q12a. NIST Post-Quantum Cryptography Standardization [40MIN] Lily Chen, Mathematician, NIST


13:40


C12b. Rethinking the Definition of the Operational Environment in FIPS 140-2 [20MIN] Kelvin Desplanque, Security Certification Engineer, Cisco Systems

 

G12b. FIPS Certification—Tales from the Dev Side [20MIN] Alan Kaye, Director, Compliance Management, Fortinet

 

E12b. FIPS 140-2 Cryptography in the IoT [20MIN] Chris Conlon, Software Engineer, wolfSSL

 

14:00


C12c. Stop Doing Grunt Work—Key to Efficiently Executing Multiple Certification Efforts [20MIN] Ashit Vora, Co-founder & Laboratory Director, Acumen Security

 

G12c. Case Study: Hybrid CM Validation Technology Challenges [20MIN] Steve Taylor, Intel

 

E12c. Identity Mixer [20MIN] Jan Camenisch, IBM Research–Zurich

 

Q12c. How to be Ready for Tomorrow’s Quantum Attacks [20MIN] Vladimir Soukharev, Cryptographer, InfoSec Global

  14:20 – 14:40   Networking Break in Exhibits (Hemingway Ballroom)


  14:40 – 15:40   Conference Sessions

  Certification Programs Track
(Ballroom DE)
  General Technology Track
(Ballroom C)
  Industry Vertical/Embedded Crypto (Ballroom B)   Quantum-Safe Crypto Track
(Ballroom A)

14:40


C13a. Is Common Criteria the New FIPS 140? [40MIN] Anthony Busciglio, Co-Founder & Laboratory Director, Acumen Security

 

G13a. Panel Discussion: Technology Challenges in CM Validation [60MIN], Panelists TBA

 

E13a. PKI and FICAM Overview and Outlook  [40MIN] Judith Spencer, PMA Chair, Certipath

 

Q13a. Preparing Today for Key Management in a Post-Quantum Computing World [40MIN] Tanja Lange, Technische Universiteit Eindhoven

       

15:20


C13c. Certification Process. Are We on the Right Track? [20MIN] Fabien Deboyser, Certification Engineer, Thales e-Security

   

E13c. FIPS-140-2 Validation of a NIST SP800-73-4 Conformant Smart Card: The Challenges Ahead [20MIN] Christophe Goyet, VP of Technology, Oberthur Technologies of America

 

Q13c. CRYSTALS and Open Quantum Safe [20MIN] Tancrède Lepoint, Computer Scientist, SRI International

  15:40 – 16:00   Networking Break in Exhibits (Hemingway Ballroom)


  16:00 – 17:00   Conference Sessions

  Certification Programs Track
(Ballroom DE)
  General Technology Track
(Ballroom C)
  Industry Vertical/Embedded Crypto (Ballroom B)   Quantum-Safe Crypto Track
(Ballroom A)

16:00


C14a. Report from Equivalency Working Group [20MIN] Edward Morris, Lab Director, Gossamer Security Solutions; Carolyn French, Manager, Cryptographic Module Validation Program, Communications Security Establishment

 

G14a. A Tale of Two Entropy Source Validation Approaches: NIST 800 90B vs. BSI AIS 31 [20MIN] Meltem Sonmez Turan, NIST

 

E14a. Overview/Case Study: Validating FIPS 140-2 Security in PIV Credential Cryptographic Modules [20MIN] Roger Butler, Chief Architect, TecSec

 

Q14a. Post Quantum Cryptography and the Future of Digital Signatures [20MIN] Florian Caullery, Dark Matter


16:20


C14b. Update on FIPS 140-3 [40MIN] Kim Schaffer, NIST

 

G14b. Entropy Estimation Methods for SW Environments in KCMVP [40MIN] Seogchung Seo, National Security Research Institute, Korea

 

E14b. An Executable Secure Mobility Solution using an NFC Crypto Module [40MIN] Richard Schaeffer, CEO, Tocreo Labs

 

Q14b. Timing and Side-Channel Countermeasures for Quantum-Safe Cryptography [20MIN] William Whyte, Chief Scientist, Security Innovation


16:40

     

Q14c. Experience with Quantum Key Distribution [20MIN] Konstantinos Karagiannis, CTO, Security Consulting Practice, BT Americas

  17:00 – 18:20   Welcome Reception in Exhibits (Hemingway Ballroom)


  18:20 – 21:00   Dine-Around DC

Enjoy an informal, on-your-own group dinner at one of DC’s best restaurants. Reserve your seat then meet your group at 18:20 at the ICMC registration desk in the foyer and depart from there. This is an “on your own” event—restaurants have reserved space for ICMC groups, participants are responsible for their own check.

Thursday, May 18, 2017

  08:00 – 09:00   Coffee in Exhibits (Hemingway Ballroom) CMUF Face-to-Face Meeting (Conference Services Center—Open to All)


  09:00 – 09:40   Conference Sessions

  Certification Programs Track
(Ballroom DE)
  General Technology Track
(Ballroom C)
  Common Criteria Track
(Ballroom B)
  Open-Source Crypto Track
(Ballroom A)

09:00


C20a. NIST & NIAP Working Together [40MIN] Janine Pedersen, Director, National Information Assurance Partnership (NIAP); Speaker TBA

 

G20a. How I Learned to Stop Worrying and Love AES-GCM [40MIN] Quentin Gouchet, atsec information security

 

R20a. Keynote Presentation [40MIN] Shawn Wells, Chief Security Strategist, Public Sector, Red Hat

 

S20a. Keynote: Driving Security Improvements in Critical Open Source Projects [40MIN] Nicko van Someren, CTO, Linux Foundation

  09:40 – 10:00   Networking Break in Exhibits (Hemingway Ballroom)


  10:00 – 11:20   Conference Sessions

  Certification Programs Track
(Ballroom DE)
  General Technology Track
(Ballroom C)
  Common Criteria Track
(Ballroom B)
  Open-Source Crypto Track
(Ballroom A)

10:00


C21a. Update on the Automated Cryptographic Validation Program (ACVP) [80MIN] Apostol Vassilev, Research Lead–STVM, CSD; Barry Fussell, Technical Leader, Cisco Systems; Steve Grubb, Red Hat; Robert Relyea, Red Hat; Shawn Geddis, Security & Certifications Engineer, Apple; John Foley, SimpliVity

 

G21a. What Type of Module Am I? [40MIN] Yi Mao, CST Lab Manager, atsec information security

 

R21a. NIAP Update [40MIN] Diane Hale, NSA

 

S21a. Inside the OpenSSL 1.1 FIPS Module Project [40MIN] Mark Minnoch, Technical Account Manager, SafeLogic; Tim Hudson, CTO and Technical Director, Cryptsoft Pty Ltd.

       

10:40

 

G21c. Trusted Cryptographic Modules, Malware and Encryption [40MIN] Steve Schmalz, CISSP Principal Systems Engineer RSA, The Security Division of EMC

 

R21c. CC Validations: Evaluation Challenges, Market Benefits [40MIN] Speaker TBA

 

S21c. FIPS Certification and the Bouncy Castle Project, or, What do you mean I can’t just do a new release tomorrow? [40MIN] David Hook, Bouncy Castle


 

     

  11:20 – 11:40   Networking Break in Exhibits (Hemingway Ballroom)


  11:40 – 12:40   Conference Sessions

  Certification Programs Track
(Ballroom DE)
  General Technology Track
(Ballroom C)
  Common Criteria Track
(Ballroom B)
  Open-Source Crypto Track
(Ballroom A)

11:40


C22a. TBA

 

G22a. Smartphone Keystores and Key Management: 2017 Edition [40MIN] William Supernor, CTO, Koolspan

 

R22a. Commercial Product Assurance: Its Relation to CC [40MIN] Simon Milford, Head of Cyber Security, DNV GL

 

S22a. Open Source Validations [40MIN] Chris Brych, Senior Principal Security Analyst, Oracle

       

12:20


C22c. Revalidation in Response to CVEs—CMUF WG [20MIN] Fabien Deboyser, Thales e-Security

 

G22c. Control Your Cloud: BYOK is Good, But Not Enough [20MIN] Matt Landrock, CEO, Cryptomathic

 

R22c. The Application of CC in the Cloud [20MIN] Speaker TBA

 

 

S22c. Network Time Protocol Overview [20MIN] Daniel Franke, Akamai

  12:40 – 13:40   Lunch in Exhibit Area (Hemingway Ballroom)


  13:40 – 14:40   Conference Sessions

  Certification Programs Track
(Ballroom DE)
  General Technology Track
(Ballroom C)
  Common Criteria Track
(Ballroom B)
  Open-Source Crypto Track
(Ballroom A)

13:40


C23a. CMVP Inside [20MIN] Carolyn French, Manager, Cryptographic Module Validation Program Communications Security Establishment; Jennifer Cawthra, Program Manager, NIST

 

G23a. Fast, Quantum-Resistant Public-Key Solutions for Constrained Devices Using Group Theoretic Cryptography [40MIN] Derek Atkins, CTO, SecureRF

 

R23a. CC for Smart Cards and Mobile Security [40MIN] Wouter Slegers, CEO, Your Creative Solutions

 

S23a. TLS Panel Discussion [60MIN] Moderator: Tim Hudson, CTO and Technical Director, Cryptsoft Pty Ltd. Panelists: Steve Marquess, OpenSSL; David Hook, Bouncy Castle


14:00


C23b. Standing With Integrity-Integrity Check Using Random Sampling [20MIN] Renaudt Nunez, IT Security Consultant, atsec information security

     

14:20


C23c. Getting Over the Self-Test Hurdle [20MIN] Alan Gornall, Principle Consultant, Rycombe Consulting

 

G23c. TBA

 

R23c. Improving cPPs with User Participation [20MIN] Quang Trinh, Cisco

 

 14:40 – 15:00   Networking Break in Exhibits (Hemingway Ballroom, Exhibits Close at 15:00)


   15:00 – 16:00   Conference Sessions

  Certification Programs Track
(Ballroom DE)
  General Technology Track
(Ballroom C)
  Common Criteria Track
(Ballroom B)
  Open-Source Crypto Track
(Ballroom A)

15:00


C24a. FIPS in China? Easier Than the Language! [20MIN] Yuan Xu, atsec information security

 

G24a. Quantum Safe PKI Transitions [40MIN] Mike Brown, CTO, ISARA Corporation

 

R24a. Panel Discussion: The Move to cPPs [60MIN] Panelists TBA. Is the move to cPPs (and the fact that they’re relying more on FIPS for their underpinning) an improvement on the EAL?

 

S24a. TLS 1.3 [40MIN] Rich Salz, Senior Architect, Akamai Technologies; Member, OpenSSL Dev Team


15:20


C24b. Australian Validation Programs Overview [20MIN] Simon Reardon, Evaluations Program, Cyber & Information Security Division, Australian Signals Directorate

     

15:40


C24c. Malaysian Validation Programs Overview [20MIN], H.A. Rani, CyberSecurity Malaysia (Invited)

 

G24c. The Evolution of the CAVP [20MIN] Sharon Keller, CAVP Program Manager, NIST

   

S24c. Penetration Testing: TLS 1.2, and Initial Research on How to Attack TLS 1.3 Stacks [20MIN] Alex Moneger, Citrix Systems

 16:00 – 16:20   Networking Break (Foyer)


  16:20 – 17:00   Conference Sessions

  Certification Programs Track
(Ballroom DE)
      Common Criteria Track
(Ballroom B)
  Open-Source Crypto Track
(Ballroom A)

16:20


C25a. International Validation Programs Overview [20MIN] Speaker TBA

 

Re-set room for CMGP

 

R25a. The Common Criteria—What’s Next? [40MIN] Joshua Brickman, Director, Security Evaluations, Oracle

 

S25a. Crypto++: Past Validations and Future Directions [20MIN] Jeffrey Walton, Consultant


16:40


C25b. Prospects for an International Cryptographic Evaluation Process [20MIN] Clint Winebrenner, Technical Lead, FIPS Cisco Systems

     

S25b. Evolving Practice in TLS, VPNs, and Secrets Management [20MIN] Kenneth White, Security Architecture, Public Cloud, Applied Cryptography Research & Development, Open Crypto Audit Project

 


  17:00 – 18:00   Cryptographic Module Game Program (Ballroom C)

Come watch three experienced contestants test their FIPS knowledge in a game of trivia related to algorithms, derived testing requirements, entropy, implementation guidance and more. A few members from the audience will be selected to assist the contestants on specific questions and be eligible to win prizes. Your Host: Nick Goble, Technical Marketing Engineer, Cisco

Friday, May 19, 2017

  08:00 – 09:00   Coffee (Foyer)


  09:00 – 09:40   Conference Sessions

  End-User Experience Track
(Ballroom E)
  Advanced Technology Track
(Ballroom C)
  Common Criteria Track
(Ballroom B)
  Crypto Policy & Ethics Track
(Ballroom A)

09:00


U30a. Keynote: Cryptographic Standards Acceptance and the User Experience [20MIN] Gordon Bass, Director, Cybersecurity Operations Office, Office of the CIO, U.S. Department of Energy

 

A30a. Keynote: The Past, Present and Future of Agile Crypto [40MIN] Taher Elgamal, CTO, Security, salesforce.com

 

R30a. Introducing the Dedicated Security Components Protection Profile [20MIN] Shawn Pinet, Senior Security & Certifications Analyst, Gemalto; Shawn Geddis, Security & Certifications Engineer, Apple

 

Y30a. Keynote: From Heartbleed to Juniper and Beyond [40MIN] Matthew Green, Johns Hopkins University


09:20


U30b. Federal Encryption Requirements Overview [20MIN], Speaker TBA

   

R30b. FIPS!…I Did It Again [20MIN] Justin Fisher, Booz Allen Hamilton

 

 

 

  09:40 – 10:00   Networking Break (Foyer)


  10:00 – 11:20   Conference Sessions

  End-User Experience Track
(Ballroom E)
  Advanced Technology Track
(Ballroom C)
  Common Criteria Track
(Ballroom B)
  Crypto Policy & Ethics Track
(Ballroom A)

10:00


U31a. Crypto: You’re Doing it Wrong [40MIN] Jon Green, Sr. Director, Security Architecture and Federal CTO, Aruba Networks/HPE

 

A31a. A Survey of the Classical and Quantum Cryptanalysis of AES [40MIN] David Cornwell, Lead Engineer, Booz Allen Hamilton

 

R31a. Development of CPPs for Full Disk Encryption [20MIN] Garry McCracken, VP, Technology, WinMagic

 

Y31a. Encryption in Real-World Implementations [40MIN] Joe Hall, Center for Democracy and Technology


10:20

   

R31b. Common Criteria Crypto Working Group [20MIN] Mary Baish, NIAP; Janine Pedersen, Director, NIAP NSA/CSS Commercial Solutions Center

 

10:40


U31c. What Does Your FIPS Certificate Say? [20MIN] Swapneela Unkule, atsec information security

 

A31c. Towards A Decentralized IBE Scheme For Securing The IoTs: Blockchain-Based Solution Using PUFs [40MIN] Hilal Houssain, cryptoc

 

R31c. Toward Continuous Certification [40MIN] Greg Mclearn, Lightship Security

 

Y31c. Encryption and Cybersecurity Policy Under the New Administration [40MIN] Neema Singh Guliani, Legislative Counsel (Privacy and Technology), ACLU


11:00


U31d. Keeping It Valid: Maintenance of FIPS 140-2 Validated Modules [20MIN] Ying-Chong Hedy Leung, Senior Consultant, atsec information security

     

  11:20 – 11:40   Networking Break (Foyer)


  11:40 – 12:40   Conference Sessions

  End-User Experience Track
(Ballroom E)
  Advanced Technology Track
(Ballroom C)
  Common Criteria Track
(Ballroom B)
  Crypto Policy & Ethics Track
(Ballroom A)

11:40


U32a. Panel Discussion: Ask the Labs [60MIN] Panelists TBA

 

A32a. MACSec Security Service FIPS Validation [20MIN] Zhiqiang Wang, Lab Manager, Gossamer Security Solutions

 

R32a. Selecting and Maintaining a Crypto Module for ISO 19790 and CC [40MIN] Iain Holness, Common Criteria Evaluator, Security Engineer Cygnacom Solutions

 

Y32a. Revisiting Threat Models for Cryptography [40MIN] Bart Preneel, Professor, University of Leuven


12:00

 

A32b. Usage of SP800-56A in Industry Standard Protocols [20MIN] Michael Powers, Security Assurance Engineer, Leidos

   

12:20

 

A32c. Avoiding Falsely Passing a Device in TVLA Testing [20MIN] Gilbert Goodwill, Senior Manager/DPA Team Lead Rambus–Cryptography Research Division

 

R32c. Satisfying CC Cryptography Requirements through CAVP/CMVP Certifications [20MIN] Anthony Apted, CCTL Technical Director, Leidos

 

Y32c. Cloud Storage with End-to-End Encryption [20MIN] Speaker TBA

  12:40 – 13:40   Lunch (Hemingway Ballroom)


  13:40 – 14:40   Conference Sessions

  End-User Experience Track
(Ballroom E)
  Advanced Technology Track
(Ballroom C)
      Crypto Policy & Ethics Track
(Ballroom A)

13:40


U33a. Updates from the Security Policy and Remote Testing Working Groups [20MIN] Ryan Thomas, FIPS 140-2 Program Manager CGI Global Labs

 

A33a. Storing Cryptographic Keys in Persistent Browser Storage [20MIN] Francisco Corella, Founder & CTO, Pomcor

 

Re-set room for Summary Panel Discussion

 

Y33a. Zero Knowledge Doesn’t Mean Zero Ethics [20MIN] Joshua Marpet, SVP, Compliance and Managed Services CyberGRC

14:00

U33b. How Random is Your Random? (Assessing Entropy with SP800-90B) [40MIN] Stephan Mueller, Principal Consultant, atsec information security

 

A33b. Efficient Application of Countermeasures for Elliptic Curve Cryptography [40MIN] Vladimir Soukharev, InfoSec Global

   

Y33b. An Evaluation Framework for Secure Messaging [40MIN] Speaker TBA

       

 14:40 – 14:50   Networking Break (Foyer)


 14:50 – 15:40   P34a. Summary Panel Discussion  [50MIN] (Ballroom B)

ICMC will end with a plenary session panel of authoritative leaders in a discussion on a topic of importance to the industry, to be selected by ICMC participants by general survey. The discussion topic will be finalized in March, and panelists will be published thereafter.