4
Days on-site
Four days. A fresh 4.0 in hand, two talks at the podium, a
Large Business Community convened for the first time, seventeen exhibitors in the hall, and a table on Thursday night that turned colleagues into comrades — tempered by four days, bonded for the mission. This is how Arlington actually felt.
A Sunday start — a hotel desk at the Renaissance Arlington got politely converted into a Small But Functional Office™. The ultrawide plugged in, the KMIP version timeline up on the main screen, slide 47 under illumination — the slide that covers the delta between v2.x and the 3.0 work still in progress — and a coffee already going cold. That's where this week began.
It ends here — on the other side of a fresh release, two talks delivered, a community we founded, and one wine cellar's worth of photographs.
Before the lights come down — the numbers.
SourceOur own counting · any miscount is honest · the oyster count remains undisclosed
There is a particular hour at a conference, somewhere after the last session of the day and before the evening plans firm up, when the exhibit corridor empties and the building lets you hear it. Patterned carpet. Pendant lights. A lone attendee walking away from a monitor that is still, gamely, playing its loop.
This is the photograph nobody takes, which is why we took it. ICMC isn't a mega-show like RSAC — it's intimate by design, a focused gathering about modules and certificates and the long paperwork of trust. And this view, taken Wednesday afternoon looking down the hall, shows it as it really is: serious work, done in plain sight.
The corridor is never neutral. At 10:37 it runs hot — every conversation you could have, happening at once.
Between sessions, the ballroom shows its hand. Chairs, chandelier, lectern. No performance, no audience — just the infrastructure of a serious conversation, waiting to resume.
Monday morning: engineering, a little duct tape, a strong opinion about entropy. By Wednesday evening — the last booth day — several hundred conversations later, it had been fantastic. Informative, relatable, the kind of exchanges we are delighted to have.
The 4.0 release. The FIPS queue. The rebranding programme. ECH, ML-KEM, the ENGINE API's retirement after twenty-six years. What a post-quantum cut-over actually looks like — not in theory, but by the 2035 deadline.
Next door, the wolfSSL team. Three booths down, the labs. The FIPS world is close-knit — and this week, it was within arm's reach. Two steps to solve what usually takes six emails. That proximity turned out to be the point.
Wednesday morning, 10:30, Studio A. The OpenSSL Large Business Community sat down for a coffee break. No agenda. No slides. No stage.
Most of the year, this community talks in PDFs — CVE coordination, embargo lists, module submissions, the correspondence that moves between compliance teams. For half an hour, we put faces to names.
In frameAnton Arapov (centre, coffee in hand) speaking with David Hook and William Bellingrath at the OpenSSL LBC meet-up · ICMC 26.
In frameJeff Johnson (left side) at the OpenSSL LBC meet-up · ICMC 26.
No agenda, just a great opportunity to meet in person and start building relationships across the community. — The brief · OpenSSL LBC · Studio A · Wed 22 Apr
FIPS validation is, in the end, a conversation between a vendor, a lab, and NIST — and the conversation goes faster when the first two are in the same room. On Wednesday, the OpenSSL Corporation management team sat down with our FIPS lab and long-standing partner Lightship for a working session: affirming the partnership, continuing the FIPS work already in motion, and putting new things on the table.
The 4.8-month average turnaround and 11-day fastest submission Tim cited in Studio E on Tuesday do not happen by themselves. They happen at tables like this one.
OutcomePartnership affirmed · existing FIPS work continues · new items on the table for the coming year.
Seventeen exhibitors in Arlington this week, drawn from six countries. The centre of gravity is North America — which tracks, because CMVP is a US–Canadian programme, and the agencies that buy validated modules are mostly theirs. The passport below groups everyone by the flag on the door of their head office, not by where the product gets written. A stamp per HQ, with the companies filed underneath.
Cabinet Six countries · seventeen exhibitors · one postmark.
The badge wall misses a whole category: the standards bodies and user forums that don't take a table but are the reason a room like this exists. They convene the working groups, write the schemas, run the analyst tracks. If you sat through a panel this week, one of these was probably in the room with you.
The same seventeen, laid out flat. The passport groups by geography; the badge wall shows what kind of room this actually is — module vendors, accredited test labs, HSM makers, standards shops, a couple of consultancies. Every conversation in the aisle this week started with one of those labels. We list ourselves first — then the sixteen neighbours who made the aisle worth walking.
That's us. Co-maintainer of the cryptographic library behind roughly every TLS handshake you made today. We took Booth №4 all week with a team of six, put three of our people on the podium, hosted a coffee break, and filed the dispatches this one wraps up.
Directory Source · icmconference.org/2026 sponsors & exhibitors
“We believe everyone should have access to security and privacy tools — whoever they are, wherever they are, or whatever their personal beliefs are — as a fundamental human right.
”
Our library is the quiet infrastructure underneath most of the HTTPS web — web servers, VPNs, fridges, satellites, the IoT sensor you forgot you installed. The thing nobody notices, but everybody uses. Arlington was where we met the people building on top of it.
Every talk we gave this week, every Tea & Cookies hour at Booth №4, every FIPS submission, every release since 4.0 — all of it lives under that sentence up there. The rest of this dispatch is just the details.
The mathematician's symbol for for all. Not for some, not just for customers, not just for the west: for all. That's the part we keep restating, because it's the part that keeps us honest — at the booth, at the podium, and here.
Why it sits here Halfway through our own week, we wanted to say it out loud again. The rest of the dispatch reads better with this sentence behind it.
It would be dishonest to write a field dispatch from Arlington and leave out the city across the river — or, for that matter, the night before it all began. On Sunday evening, the tufted-leather booth at Old Ebbitt Grill settled the question of whether the only thing better than shipping cryptography is eating dinner after shipping cryptography. (It is. It's not close.) The oyster count, as always, remains undisclosed.
On the other evenings, the Metro ran late. The monument lit up. The Hotel Washington, for reasons lost to the archive but very much appreciated, lit itself red, white and blue for the week — the kind of civic flourish you stop and photograph even when your feet have already finished walking.
There is something deeply right about a wine cellar surrounding conversations about post-quantum algorithms in the evening.
The conference ends on a Thursday. The booth comes down in the afternoon. The badges get tucked into laptop bags. Somebody asks where are we going, and somebody else has already booked it.
1101 Pennsylvania Avenue NW — the Evening Star Building, a National Register landmark with a Beaux-Arts façade a few hundred metres from the White House. Inside: two floors of dining, a soaring wine display, and Brazilian gauchos working the floor with skewers the size of small oars. Fogo de Chão, which translates roughly to fire of the ground — the Southern-Brazilian churrasco tradition, established 1979, fire-roasted Picanha carved tableside, the Market Table somewhere in the middle for the brave, and a cocktail list long enough to forget your own boarding pass over.
Around that long table: OpenSSL Corporation, several members of the OASIS KMIP Technical Committee, and friends. A group that hadn't actually sat down to dinner together since 2018 — seven years, a pandemic, two presidential administrations, and roughly a hundred standards-track revisions ago. The pretext tonight was ICMC 2026. The excuse was overdue.
Judy and Tim kept finding each other across the table — and for good reason. Tim co-founded RSA Security's Australia office in 1998 and spent nearly a decade there on the BSAFE cryptographic toolkits. Judy's corner of Dell Technologies runs through what was, until recently, RSA at EMC at Dell — the same lineage, inherited through two acquisitions. A quarter-century of overlapping orbits: BSAFE, the RSA Conference floor, the OASIS KMIP Technical Committee (which they've co-shepherded for well over a decade), ICMC. Two careers'-worth of mutual archive, traded in fragments: that standards meeting in whenever-it-was, that vendor who insisted on the thing, the person who'd since retired. The rest of us listened in on the sort of conversation you can't fake and can't schedule; it's only earned by having both been there.
Bruce Rich worked a different register. Many years at IBM as an engineer — IBM being one of the original KMIP participants — before joining Cryptsoft. An extreme owl with a dry sense of humour and a world of wisdom; the kind of dinner company who can take a table of nine and make it feel like six old friends and three new ones. When Bruce lands a line, you hear it a beat later.
The food did what food does at the end of a long week. The churrasco rounds kept coming. And then, improbably, the highlight of the evening was not any of the meats: it was the grilled pineapple — charred on the rodizio skewer, cinnamon-dusted, warm and faintly caramelised — passed down the table with the kind of surprised approval that meant people had actually stopped to notice. Wait, try this.
There's a particular kind of laughter that only happens on the last night of a conference. Four days of being on. Everyone working their corner of the booth, making every handshake and every demo count. This was the pause between — a breather before the plane home, before the follow-ups and the thank-yous, before whatever's round the corner next.
You can ship a library, give the talks, staff the booth, collect the badges — and in the end what stays with you is the new friends you made and the old ones you caught up with.
The badges go in a drawer. The rest doesn't.
— Overheard · Evening Star Building · somewhere near the caipirinhas
The photograph we stopped for. Six people. One booth. Agenda board still propped beside them.
On Sunday, a hotel desk became an office; a joint got taped in the booth backdrop that nobody ever noticed. Tuesday afternoon, Studio E — Tim reading five governance documents into the record. Wednesday, 11:00, Salon 1-3 — Thomas on PQC in the OpenSSL Library. Wednesday afternoon — OpenSSL Corporation hosting the first LBC coffee break of its kind.
Four days. Six people. One booth. Done.
Six of six The masthead, in full. Two engineers, a manager, a director, business development, and the president — the team that ran Booth 4.
Dispatch № 026 opened on a Sunday at 05:47, from room 1108 of the Renaissance Arlington Capital View — a pre-dawn runway, low cloud, a KMIP version timeline quietly stretched across the ultrawide from v1.0 to v3.0, slide 47 already open. This one closes from the same window, only now the tower is lit, the ramp is busy with late arrivals, and the clock is running the other way.
Then the aircraft. Then the wing. Then an orange, obliging sunrise somewhere over the clouds, and a whole year to plan the next one.
Four days. One city. A booth that held up, a podium that held serious conversation, a mission restated in daylight, and a table on Thursday night loud enough to remind us why we do this.
We came to Arlington representing OpenSSL Corporation — to hear the questions and answer them, to show up with the people behind the project, and to broaden our world domination, just a little, one honest conversation at a time.
We're leaving with friends, a first-of-its-kind community convened, and the conviction — restated once more — that security and privacy really are for everyone.
Thank you to everyone who stopped by Booth №4, sat through a talk, poured a coffee, shared a table, or simply said hello in the aisle. The week worked because you showed up.