§ 02 — Agenda
Edition 02 · 12—15 October 2026
Our agenda,
your
spark.
The programme — 97 sessions across three days and four rooms
Mon 12Tutorials Dayadd-on · opening night
Tue 13Day 01 · The Arcopening · boat night
Wed 14Day 02 · The Filamentdeep-dive · Folklore Garden
Thu 15Day 03 · The Effectclose · plenary
Tracks
04
Rooms
04
Sessions
97
Speakers
110
Countries
30
§ 03 — Agenda
The programme, day by day.
§ A note on reading How to read the Agenda
Main Stage · Room 1
§ 01 · the plenary hall
The main stage — welcomes, keynotes, panels, and invited sponsor talks, plus parallel sessions through the afternoons.
Hall II · Room 2
§ 02 · parallel
Parallel sessions, Tuesday afternoon through Thursday.
Hall III · Room 3
§ 03 · parallel
Parallel sessions, Tuesday afternoon through Thursday.
Hall IV · Room 4
§ 04 · parallel
The smallest room. Parallel sessions, Tuesday afternoon through Thursday.
Day00
Monday · 12 October · pre-conference add-on
Tutorials
Day · hands-on, three rooms
Mon12 Oct
Monday · 12 October · pre-conference add-on
Tutorials
Day · hands-on, three rooms
09:00
Tutorial
Code along
10:30
— Morning Tea —
11:00
Tutorial
Code Along
11:00
Tutorial
Tokens - load rust
11:00
Tutorial
Build your own provider
12:30
— Lunch —
13:30
Tutorial
Code along
13:30
Tutorial
Tokens
13:30
Tutorial
Build your own provider
15:00
— Afternoon Tea —
15:30
Tutorial
Code Along
17:00
— Finish Tutorial Day —
17:30
— Host Dinners · Tim, David and Matt —
20:00
— Conference Opening Evening · Diplomat Hotel —
Day01
Tuesday · 13 October
The
Arc · foundations & community
Tue13 Oct
Tuesday · 13 October
The
Arc · foundations & community
09:00
Main Stage
Performance
09:05
Plenary ·
Magda Zdunkiewicz
Conference Opening
09:10
Plenary ·
Tim Hudson,
Anton Arapov
Welcome to the OpenSSL Conference 2026
09:20
Plenary ·
Eric Young,
Tim Hudson,
Matt Caswell,
Magda Zdunkiewicz
Three Decades of OpenSSL: A Leadership Conversation
10:20
Plenary ·
Jonathan Felten
The Last Mile of Trust
10:50
Plenary ·
Lisa Rogers
Beyond the Checkbox: How Product Certifications Drive Ongoing Security Strategy and Market Access
11:20
Plenary ·
Marcel Dasen
Post-Quantum Cryptography: Why Moving Too Fast Can Be as Risky as Moving Too Slowly
12:00
— Lunch —
13:10
Main Stage
Performance
13:20
Plenary ·
Kevin Füchsel
Spooky Action at a Distance – Entanglement-Based QKD in Practice, From the Physical Layer to the Application
13:50
Plenary ·
Jonathan Park
Rebranding OpenSSL: A Laboratory Perspective
14:20
Plenary ·
Justin Corlett
OpenDaiY — Move fast and make things.
14:50
— Afternoon Tea —
15:20
Post-Quantum Cryptography: Evaluation, AI Threats and the Future
15:20
Why have the PQC standards taken so long? Bottlenecks, bickering, and building momentum
15:20
What's behind the MASQUE
15:20
Open Quantum Safe: Post-Quantum software research in the era of the first PQC standards
16:05
OpenSSL's TLS Implementation: Inside the State Machine and Record Layer
16:05
PLANTS and Merkle Tree Certificates
16:05
During a Breach: How Encryption is Evaluated by Regulators, Insurers, and Counsel
16:05
Architecting the Agility Layer: Forging a Common Crypto API for the Post-Quantum Era
17:00
Privacy Is Not the Enemy! What Law Enforcement Misunderstands and What Cryptographers Can Do About It
17:00
Self-Encrypting Disks in Linux - Fast, Expensive, and Mostly Harmless
17:00
Instrumenting OpenSSL with Crypto-Auditing Probes for Post-Quantum Readiness
17:00
Protecting the Human in a Digital World: How CyberCat Translates Digital Security into Safer Human Decisions
17:30
Integrating Multiple Randomness Sources in an SP 800-90C RBGC Framework
17:30
How small can you (reasonably) get an ML-DSA and ML-KEM implementation?
17:30
New Insights into the Formal Verification of AWS-LC, a Fork of OpenSSL
17:30
One Module Three Transitions
18:00
— End of Day —
19:00
— Boat transport starts —
19:30
— Boat Event · dinner and Cruise (starts 19:45) —
Day02
Wednesday · 14 October
The
Filament · deep-dive
Wed14 Oct
Wednesday · 14 October
The
Filament · deep-dive
09:00
Plenary ·
Tim Hudson,
Anton Arapov
OpenSSL Corporation Keynote
09:30
Nobody Told Maintainers They Were Saving The World. Now Is The Time.
09:30
A library-agnostic hybrid classic/PQ OpenSSL provider — built with AI
09:30
Shipping OpenSSL downstream and its challenges
09:30
Fresh Eyes on OpenSSL: A Newcomer's Report
09:45
Securing the Next Generation: An OpenSSL Youth Outreach Strategy
10:00
— Morning Tea —
10:30
TLS keyshare caching for faster handshakes
10:30
From Copilot to Commit: Handling AI-Generated Code in Open Source Crypto Libraries
10:30
"git revert" review of an OpenSSL fork
10:30
Finding Timing Side Channels When Internal Clocks Are Hidden
11:00
Dr. Tokenlove or: How Bouncy Castle Learned to Stop Worrying and Love the LLM
11:00
What shall we do with two PKCS#11 providers?
11:00
Who Pays for Open Source? A First-Party Answer from the OpenSSL Corporation
11:00
Navigating the Post-Quantum Transition: Integrating FAEST and Classic McEliece into libOQS
11:30
Hybrid FIPS module using OpenSSL code: the Kryoptic project
11:30
Crypto4A — Session Title Coming Soon
11:30
Is the current cryptography testing and validation pipeline process capable of handling the impending Tsunami?
11:30
Engineering Reality of CRA Compliance for Linux-based IoT Solutions
12:00
— Lunch —
13:20
Main Stage
Don McMillan Performance: Technically Funny
14:20
Migration roadmaps and PQC standards -- A European perspective
14:20
Open Source: The Road to EU Sovereignty
14:20
Community panel: Distributions
14:20
Optimizing ML-KEM and ML-DSA with Vector Instructions and Mathematical Techniques
15:00
— Afternoon Tea —
15:30
Artificial Insecurity: how AI threatens digital security and what we can do about it
15:30
When Hallucinations Become Vulnerabilities: Building Reliable AI for Cryptography
15:30
DTLS 1.3 in OpenSSL
15:30
Building Cryptography on Locally Verified Entropy
16:10
Legal and Commercial Pitfalls of Poor Open Source and IP Management
16:10
Testing PQC Timing Side-Channels
16:10
Investigating cryptography deployments in security-certified products with sec-certs
16:10
Shim in 2026: A Certificate Rotation and a Decade-Overdue OpenSSL Migration
16:50
Paul Yang,
Jaroslav Řezník,
Randall Becker,
Jeff Johnson,
Nikolas Gauder,
Simo Sorce,
Dmitry Belyavskiy,
Aditya Koranga,
Chris Ward
OpenSSL Corporation Business & Technical Advisory Committees Panel
16:50
Jipher FIPS cryptography provider - Wrapping OpenSSL and the FIPS module using Java’s FFM API
16:50
Beyond Algorithms: Exploiting Platform Cryptography with OpenSSL Providers
16:50
The Bear Leap – How Polar Bear Care Has Transformed at Zoo Brno
17:30
450 CVEs Later: Lessons from Securing Open Source with AI
17:30
Zero-Overhead Cryptography in OpenSSL-Powered Network Stack
17:30
Lessons Learned from Constructing Estonia’s PQC Migration Roadmap
18:00
— End of Day —
19:00
— Transport to Folklore —
19:30
— Folklore Performance and dinner —
Day03
Thursday · 15 October
The
Effect · close
Thu15 Oct
Thursday · 15 October
The
Effect · close
09:00
Plenary ·
Matt Caswell
OpenSSL Foundation — Delivering the Mission
09:30
The Security Response Process of the OpenSSL Library
09:30
The Last Mile of PQC Migration: From Cryptographic Inventory to Production Remediation
09:30
Post-Quantum Cryptography on a Budget: Benchmarking ML-KEM and ML-DSA on Constrained IoT Hardware
09:30
Jostle, OpenSSL's new Java Cryptography Provider for JVMs 8 to 25+, with FIPS support
10:00
— Morning Tea —
10:30
Getting a subroutine right: a case study
10:30
Going beyond constant-time security in open-source cryptographic libraries
10:30
IT Security Product Certification in the Era of Automated Evidence Generation and AI-Assisted Evaluation
10:30
From OpenSSL 3 to OpenSSL 4 in Fedora: true story
11:15
The Case for Binding and Embedding – Many Modules One Validation
11:15
The Family Reunion: OpenSSL, BoringSSL, AWS-LC, and LibreSSL on Why They Forked and What Happens Now
11:15
CRA and its Problematic Impacts on F/OSS
11:15
DTLS 1.3 in the Linux Kernel via wolfSSL Kernel Module
12:00
— Lunch —
13:20
Plenary ·
Peter Gutmann,
David Hook,
Megan Woods
AI in Open-Source Cryptography: Maintainers Compare Notes
14:00
The State of the OpenSSL Community
14:00
Composites Aren’t Optional: Designing PKI for the Post-Quantum Transition and Beyond
14:00
Performance: The little sibling of cryptography
14:00
Student Bug Bounties for OpenSSL-Based Products
14:30
The Cost of Stunt Cryptography
14:30
AI assisted PQC integration in Bouncy Castle
14:30
FIPS 140-3 Meets PQC - The Compliance Gap Nobody Planned For
14:30
From Hidden Cryptography to Enterprise Risk: Securing Ecosystems for Cryptographic Compliance and Post-Quantum Readiness
15:00
— Afternoon Tea —
15:30
Beyond copyright: IP strategy in the age of generative AI
15:30
The EU CRA vs. Community: Why You’re Safe, and How Stewards Help
15:30
Hardware-enforced cryptographic contexts that RISC-V software can use but never read.
15:30
Managing millions of sboms with trustify
16:15
TLS 1.3, session resumption, 0-RTT early data, external PSKs and all that...
16:15
EU CRA is around the corner. Are you ready?
16:15
Breaking Deepfakes with Shared Secrets
16:15
Quantum-Resilient Confidential Computing: Securing Data in Use for the AI Era
17:00
Shubham Kumar,
Clemens Lang,
Randall Becker,
Yi Ouyang,
Nicola Tuveri,
Dmitry Belyavskiy, Igor Ustinov,
Aditya Koranga,
Jon Ericson
OpenSSL Foundation Advisory Committee
17:00
Re: [URGENT] Eight Critical 0-Day Vulnerabilities in OpenSSL
17:00
From 1.1.1 to 3.5: Modernizing OpenSSL for Enterprise Networking, FIPS 140-3, and Crypto Agility
17:00
OpenSSL QUIC adventure
17:40
Main Stage
Closing Performance
§ 03 — 97 sessions scheduled · four rooms · invited topics announced
as they land
Monday, before the arc strikes.
A whole day of hands-on workshops the day before the conference proper — in three room types, with the people who built the libraries you ship. Limited seats, paid add-on.
- In the round Horseshoe · code-along
- The walking lecture Grid · the long view
- The hardware bench Devices forward · HSMs & tokens
Confirmed tutors
Bouncy Castle engineering ·
Prof. Bill Buchanan ·
Daniel Heinrich
· more locking in through spring
See tutorials
~80 seats across the day · paid add-on