OpenSSL Foundation at ICMC 2026

Last month, I attended the International Cryptographic Module Conference (ICMC) 2026 in Arlington, Virginia from April 20–23. It’s a focused event that brings together developers, FIPS validation labs, users and employees of government standard bodies.

A lot of the discussion this year centered on how quickly the landscape of cryptographic implementations is changing. Implementations of post-quantum algorithms are now being validated and deployed however the amount of use of existing quantum-vulnerable applications that still needs to be migrated is huge. The use of AI is also a seriously challenging factor in the security sensitive area of cryptographic modules.

The sessions this year continued the post-quantum migration theme but also covered topics like upcoming updates of the related government standards or recent advances in the area of random number generators. In particular I have enjoyed talks on the topic of formally verified cryptography implementations from Dusan Kostic who has been presenting about formally verified cryptographic implementations in the aws-lc library and Nicky Mouha who provided interesting notes about the limitations of the formal verification approaches.

From an OpenSSL perspective, these topics are directly relevant. We are currently investigating the options for getting formally verified crypto implementations being used with OpenSSL Library APIs.

I would like to emphasize that for me the most useful thing was to exchange ideas and share the concerns in relation to the recent advances in the field with other attendees of the conference. The event really provides an excellent place for this kind of conversation.

Overall, ICMC continues to be an important yearly opportunity to learn new things and meet with relevant people in the area of cryptographic module implementations.