May 14-17, 2019 | JW Marriott Parq Vancouver, Canada

Presentations by Topic

Certification Programs

Day 1
15 May 2019

Latest Cryptographic Module Test Technology Development Trends of KCMVP (C11a)

This presentation will introduce the major test technology development trends of KCMVP. Korea has been operating its own cryptographic module validation system since 2005 and has been conducting tests based...
Read More
Sung Ha Lee

Update on the Canadian Centre for Cyber Security (C11b)

This presentation will introduce the new Canadian Centre for Cyber Security (CCCS or Cyber Centre), a branch of the Communication Security Establishment (CSE). We’ll focus on who we are in...
Read More
Keith Merlo
Roy Crombie

CMVP Programmatic Update (C11d)

This presentation will provide the latest from the CMVP: from new and updated Implementation Guidance to lab accreditation changes, and all initiatives in between.
Beverly Trapnell
Carolyn French

Pearson Testing (C12a)

Gavin O’Brien

CCUF Update (C12c)

The CCUF would like to present an update on their activities.
Fiona Pattinson

ACVP Update (C13a)

Christopher Celi

With ACVP done what’s next on the road to automating the NIST crypto validation programs? (C13b)

NIST is working in close collaboration with the industry to address the shortcomings of the NIST Cryptographic Validation Programs and improve the efficiency and effectiveness of cryptographic module testing in...
Read More
Dominic Rizzo
Tim Anderson
Robert Relyea
Shawn Geddis
Apostol Vassilev
Day 2
16 May 2019

Secure Components – Certification That Benefits Edge, Fog & Cloud (C21a)

We are becoming increasingly ‘digitally dependent’, with connectivity spanning from our Edge devices, through the Fog and into the Cloud, helping us to manage every aspect of our personal, business...
Read More
Olivier Van Nieuwenhuyze

PSA Certification Programme (C21b)

This presentation will give a very brief introduction to Arm Platform Security Architecture (though that is a separate submission) and then explains why Arm have decided to introduce a new...
Read More
Rob Coombs
Marcus Streets

FIDO Authenticator Certification – FIPS 140-2 Companion Program (C21c)

The FIDO Alliance, a 250+ member association developing specifications and certification programs for simpler, stronger authentication, announced back in March 2018 the expansion of its certification program to include multi-level...
Read More
Roland Atoui

Securing a Connected World – How to create a certification Landscape (C22a)

This presentation will discuss the following problems: * Not all certification levels fit * How do you include HW/SW/Edge/Cloud? * Patching security issues * How do you re-use from 1...
Read More
John Boggie

Smart CC and CC-like Private Schemes (C22b)

Description TBA
Wouter Slegers

Composite Evaluation Approach Derived from Decades of Experience in Smart Card Evaluations for HSM and SAM (C22c)

Mandated in 2018, eIDAS (electronic IDentification, Authentication and trust Services) is an EU regulation defining standards for electronic signatures, qualified digital certificates, electronic seals, timestamps and other proof of authentication...
Read More
Maria Fravventura

A new european regulation landscape for secure signature devices (C23a)

No one doubts that the handwritten signature will eventually be replaced by the digital signature. The European union is evolving towards new regulations for these systems based on certification. New...
Read More
Gonzalo Porlan

eIDAS: Will Common Criteria Replace FIPS 140-2? (C23b)

Over the past few years, assessment of compliance of products and services with the eIDAS regulation has been at the center of extensive debate. Product developers, service providers, certification authorities,...
Read More
Arnold Abromeit
Graham Costa
Dieter Bong
Jonathan Allin
Maria Fravventura
Day 3
17 May 2019

Dealing with Overlapping Certification Requirements and Maximizing Your FIPS Investment (C31a)

This presentation will provide an overview of testing deemed necessary in FIPS and a summary of the challenges and opportunities for re-use in other Certifications based on lessons learned from...
Read More
Smita Mahapatra
Shawn Pinet

ISO/IEC 19790 Updates (C31b)

ISO/IEC 19790 provides the security requirements for a cryptographic module. Originally based on the U.S. FIPS 140-2, the ISO version has been further developed and improved in subsequent editions. The...
Read More
Michael Cooper
Fiona Pattinson

FIPS 140-3 Update (C31c)

Description TBA
Matthew Scholl

NIST and NIAP Working Together (C32a)

Description TBA
Mary Baish
Michael Cooper

FIPS and CC : Symbiotic Certifications (C32b)

Description TBA
Brian Wood
Erin Connor
Shawn Geddis
Nithya Rachamadugu

Common Criteria

Day 1
15 May 2019

A Protocol Protocol (G13b)

Representation of protocols such as TLS, SSH and IPsec vary widely in the Security Policies for modules validated to FIPS 140-2. This presentation covers associated guidance, representation of ciphersuites (and...
Read More
Steve Weymann
Day 2
16 May 2019

FedRAMP Introduction (G21a)

Cloud is becoming a dominant tool for various government agencies. Hence securing the cloud has become a paramount task. FedRamp is US standard for clouds. In spite of FedRamp enforcement,...
Read More
Ravi Jagannathan

PSA Certification Programme (C21b)

This presentation will give a very brief introduction to Arm Platform Security Architecture (though that is a separate submission) and then explains why Arm have decided to introduce a new...
Read More
Rob Coombs
Marcus Streets

Composite Evaluation Approach Derived from Decades of Experience in Smart Card Evaluations for HSM and SAM (C22c)

Mandated in 2018, eIDAS (electronic IDentification, Authentication and trust Services) is an EU regulation defining standards for electronic signatures, qualified digital certificates, electronic seals, timestamps and other proof of authentication...
Read More
Maria Fravventura

eIDAS: Will Common Criteria Replace FIPS 140-2? (C23b)

Over the past few years, assessment of compliance of products and services with the eIDAS regulation has been at the center of extensive debate. Product developers, service providers, certification authorities,...
Read More
Arnold Abromeit
Graham Costa
Dieter Bong
Jonathan Allin
Maria Fravventura
Day 3
17 May 2019

Dealing with Overlapping Certification Requirements and Maximizing Your FIPS Investment (C31a)

This presentation will provide an overview of testing deemed necessary in FIPS and a summary of the challenges and opportunities for re-use in other Certifications based on lessons learned from...
Read More
Smita Mahapatra
Shawn Pinet

Evaluating Cryptography in a Common Criteria context (K32a)

Cryptography is almost in all IT products providing security. As such, the evaluation of the cryptographic code is part of a Common Criteria evaluation. On the other side, in a...
Read More
Maria Christofi

Embedded Crypto and IoT

Day 1
15 May 2019

Emerging Cryptography Trends in the Internet of Things (E11b)

With the explosive growth of Internet of Things coupled with 5G communications and re-utilization of GSM 200kHz band for localized IoT applications, industry is going forward with massive investments in...
Read More
Chuck White

Building trust takes time. Or just cryptography and secure execution? (E11c)

Driven by digitalisation of “everything”the trust in digital devices of all types and their authenticity and integrity becomes a critical factor for the success of new offerings and business models....
Read More
Martin Oczko

Encryption Standardization for NVDIMM-N class PMEM devices (E11d)

A non-volatile DIMM (NVDIMM) is a Dual In-line Memory Module (DIMM) that maintains the contents of Synchronous Dynamic Random Access Memory (SDRAM) during power loss. An NVDIMM-N class of device...
Read More
Sridhar Balasubramanian

IoT and the NISTIR 8200: A Step Towards Standardization (E12a)

The NISTIR 8200 report addresses the growing need to develop effective security standards for the Internet of Things (IoT). They have identified a wide range of critical categories impacted by...
Read More
Jennifer Brady

FIPS Validation and Mission-Critical IoT Ecosystems (E13a)

Internet of Things (IoT) ecosystems have become increasingly prevalent, fundamentally changing the way we live, work and play. Billions of IoT devices already exist, with hundreds more coming online each...
Read More
Loren Shade

HSM requirements for V2X connected cars communications (E13b)

The automotive industry has rapidly evolved in recent times in such a way that the cars have been transformed from a simple mode of transport to the ultimate mobile device....
Read More
Jose Emilio Rico

Securing the Smart City: Architectural Considerations for CA and Remote Key Distribution (E13c)

The importance of connected devices, services, and platforms in modern society is growing rapidly, and nowhere is this more apparent than the smart city. Made up of a wide range...
Read More
Adam Cason
Day 2
16 May 2019

IoT TLS: Why It Is Hard (S21b)

TLS (formerly SSL) is fairly well known, and most people are familiar with it through the ‘s’ at the end of the ‘https’ in web URLs. Securing communication is also...
Read More
David Brown

Entropy

Day 1
15 May 2019

Entropy as a Service – A scheme, implementation, experience (G11c)

Cryptography is facing new challenges with new technologies such as IoT, Cloud, Quantum Cryptography etc. As the number of secure connections are exponentially increasing, key generation, strength of keys are...
Read More
Ravi Jagannathan
Apostol Vassilev

Random Numbers, Entropy Sources and You (G12a)

The NIST Special Publication (SP) 800-90 series of recommendations provide guidance on the construction and validation of random bit generators in the form of deterministic random bit generators or non-deterministic...
Read More
John Kelsey

Evaluation and Validation of Random Bit Generators (N12b)

Description to come:
Werner Schindler
John Kelsey
Joshua Hill
Allen Roginsky
Apostol Vassilev
Day 2
17 May 2019

The IID Assumption and You! (N31a)

In an SP800-90B assessment, the vendor must determine if their noise source supports an IID assumption, and justify any claim that the source output is IID. The SP800-90B IID assessment...
Read More
Joshua Hill

On the Next Revision of SP 800-90B (N31b)

NIST SP 800-90B – Recommendation for the Entropy Sources used for Random Bit Generation provides guidance for the development and validation of entropy sources. The recommendation is published in January...
Read More
Meltem Sonmez Turan

A Framework for Side-Channel Resistant Hardware/Software Codesign Using Quantum Crypto-Module (QCM) Supported by Quantum Entropy Chip (QEC) (N31c)

With the advent of the Internet of Things (IoTs), all kinds of modern electrical devices such as smart phones, medical devices, network sensors as well as traditional computing platforms are...
Read More
Junghyun Francis Baik
Jongwon “JP” Park

Presentations by NIST

Day 1
14 May 2019

FIPS 140-2 Validation Process: Overview and Case Study (W00b)

An in-depth look at the real-world process of validation with input from professionals who have hands-on experience at each step. Includes a case study of an actual validated CM product.
Alex Calis
Diana Robinson
Brad Proffitt
Ian Hall

Workshop on Automated Cryptographic Validation Protocol (ACVP) (W01b)

NIST is working in close collaboration with the industry to address the shortcomings of the NIST Cryptographic Validation Programs and improve the efficiency and effectiveness of cryptographic module testing in...
Read More
Philip Perricone
Christopher Celi
Barry Fussell
Stephan Mueller
Apostol Vassilev
Day 2
15 May 2019

Second Round Candidates in NIST PQC Standardization (Q11b)

After about one-year analysis and evaluation on the first-round candidates, NIST announced the second-round candidates in January 2019. In this presentation, we will provide a summary on the second-round candidates...
Read More
Dustin Moody
Lily Chen

Entropy as a Service – A scheme, implementation, experience (G11c)

Cryptography is facing new challenges with new technologies such as IoT, Cloud, Quantum Cryptography etc. As the number of secure connections are exponentially increasing, key generation, strength of keys are...
Read More
Ravi Jagannathan
Apostol Vassilev

CMVP Programmatic Update (C11d)

This presentation will provide the latest from the CMVP: from new and updated Implementation Guidance to lab accreditation changes, and all initiatives in between.
Beverly Trapnell
Carolyn French

Random Numbers, Entropy Sources and You (G12a)

The NIST Special Publication (SP) 800-90 series of recommendations provide guidance on the construction and validation of random bit generators in the form of deterministic random bit generators or non-deterministic...
Read More
John Kelsey

Pearson Testing (C12a)

Gavin O’Brien

Evaluation and Validation of Random Bit Generators (N12b)

Description to come:
Werner Schindler
John Kelsey
Joshua Hill
Allen Roginsky
Apostol Vassilev

ACVP Update (C13a)

Christopher Celi

With ACVP done what’s next on the road to automating the NIST crypto validation programs? (C13b)

NIST is working in close collaboration with the industry to address the shortcomings of the NIST Cryptographic Validation Programs and improve the efficiency and effectiveness of cryptographic module testing in...
Read More
Dominic Rizzo
Tim Anderson
Robert Relyea
Shawn Geddis
Apostol Vassilev
Day 3
16 May 2019

On Password Hashing and Password Hardening Schemes (G21b)

Passwords are the most cost effective and widely deployed means of human-computer authentication regardless of their vulnerability to dictionary attacks. Password hashing schemes (PHSs) compute password hashes, typically to be...
Read More
Sweta Mishra
Meltem Sonmez Turan

Validating the Implementations of the “New” and “Old” Key Establishment Standards (G22c)

The recent NIST publications of new versions of the key establishment standards formed a complicated landscape for the CMVP, the implementers, and testers. The standards keep evolving, the new parameter...
Read More
Allen Roginsky

Towards Standardization of Threshold cryptography at NIST (G23c)

The computer security Division at the National Institute of Standards and Technology is taking steps toward the standardization of threshold schemes for cryptographic primitives. These schemes have the potential to...
Read More
Nicky Mouha
Luis T.A.N. Brandao
Apostol Vassilev
Day 4
17 May 2019

ISO/IEC 19790 Updates (C31b)

ISO/IEC 19790 provides the security requirements for a cryptographic module. Originally based on the U.S. FIPS 140-2, the ISO version has been further developed and improved in subsequent editions. The...
Read More
Michael Cooper
Fiona Pattinson

On the Next Revision of SP 800-90B (N31b)

NIST SP 800-90B – Recommendation for the Entropy Sources used for Random Bit Generation provides guidance for the development and validation of entropy sources. The recommendation is published in January...
Read More
Meltem Sonmez Turan

FIPS 140-3 Update (C31c)

Description TBA
Matthew Scholl

NIST and NIAP Working Together (C32a)

Description TBA
Mary Baish
Michael Cooper

The new NIST reference for Randomness Beacons (A32c)

A randomness Beacon produces timed outputs of fresh public randomness. It pulsates randomness in an expected format at expected times, making it available to the public. Beacons offer the potential...
Read More
Rene Peralta
Luis T.A.N. Brandao
John Kelsey