The first FIPS ’n’ Chips conference is now part of our history, but the conversations it started are only beginning. Over two days in Austin, more than 200 participants from industry, government, and academia came together to explore cryptographic security, confront practical validation challenges, celebrate shared achievements, and discover how much can happen when a community has the chance to meet face to face.
Organized by the nonprofit Crypto-V Alliance (CVA), the inaugural gathering was ambitious in both scope and spirit: rigorous technical exchanges, an approachable training track, recognition of the people behind the work, and plenty of room for conversation, connection, and laughter. Five themes capture what made this first FIPS ’n’ Chips memorable—and what we hope to build next.
A first of its kind, shaped by the community
FIPS ’n’ Chips brought together participants who ranged from seasoned FIPS 140 practitioners to newcomers, including university students, high-school computer science teachers, and young people interested in STEM. Among the seasoned practitioners were researchers, product developers, testing laboratories, regulators, and educators, some of whom don’t get opportunities to directly speak with each other often. That breadth of experience was not incidental: creating opportunities to learn from one another is central to CVA’s mission.
The conference also benefited from exceptional engagement by the National Institute of Standards and Technology (NIST) and the wider validation community, with Kevin Stine, Director of NIST’s Information Technology Laboratory, delivering the opening keynote. Leaders of the Cryptographic Module Validation Program (CMVP), members of the Cryptographic Module User Forum (CMUF), and many other experts joined discussions that connected standards and policy with the realities of engineering and testing.
Even the format invited participants to explore. Day 1 plenary sessions took place at the University of Texas at Austin’s Peter O’Donnell Jr. Building, while on Day 2, attendees chose between the CMVP Deep Dive Track at the AT&T Hotel and Conference Center and the FIPS Beginner Training Track at Google’s Sail Tower Community Space downtown, before rejoining for the closing technical sessions. The three venues were generously made available, helping keep registration affordable—especially for students—and turning the event into a small tour of UT Austin and the city.
The result was a conference that felt both technically serious and genuinely welcoming: a place where people who develop, test, and rely on cryptography could exchange ideas directly, while newcomers found an accessible way into the conversation.
Technical depth, forward-looking discussions, and knowledge sharing
Across the plenary sessions and two specialized tracks, a recurring question emerged: How can cryptographic assurance keep pace with the technologies and deployment models it is meant to protect and the threats it is meant to protect against? The answers were not simple, and that was precisely the value of bringing researchers, vendors, laboratories, and program leaders into the same conversation.
Kevin Stine’s keynote set a broad horizon, tracing the role of public cryptographic standards in digital trust while looking ahead to post-quantum cryptography (PQC), cryptographic agility, AI-enabled systems, cloud services, and increasingly complex platforms. The Day 1 panel on the post-quantum transition carried that discussion into implementation realities: moving from published algorithms to secure products and validated deployments will require coordination across the entire ecosystem. Presentations on the post-quantum signature gap and the capacity of today’s testing and validation pipeline reinforced that urgency.
Other plenary discussions widened the lens. A presentation on private information retrieval illustrated the research frontier of privacy-preserving computation. The entropy panel examined the physical and technical foundations of trustworthy randomness, while sessions on non-human authentication and lessons from real-world security failures showed why assurance requirements must be understood in the context of modern systems. The panel “When AI Meets Cybersecurity” posed two questions with growing relevance: What can AI do for security, and what must security do for AI? Together, these topics connected advances in cryptography with the systems and people responsible for deploying it safely.
On Day 2, the CMVP Deep Dive Track moved from broad challenges to specific engineering and policy choices. A working session with CMVP leadership examined what it would mean to incorporate changes from ISO/IEC 19790:2025 into the existing FIPS 140-3 framework, where speakers highlighted the implications for test requirements, implementation guidance, validation tools, documentation, and resources already stretched by the PQC transition. The discussion was deliberately exploratory: proposals for selective adoption and phased implementation were offered for community consideration, not announced as final CMVP decisions.
PQC readiness remained a strong thread. Sessions explored how hardware security modules can be designed with quantum-safe roots of trust and cryptographic agility from the outset, as well as how standardized post-quantum algorithms move into automated testing and eventual module validation. The practical message was clear: the transition is not merely an algorithm swap. It touches device architecture, firmware, key management, certification timelines, and long-lived systems.
The track also demonstrated how varied the building blocks of assurance have become. Talks examined a novel electromechanical entropy source involving moving dice, advances in metastability-based digital noise sources, and the evidence needed to evaluate physically unclonable functions in silicon. Other speakers explored compositional approaches to validating complex chips, the work required to adapt a large PCI-HSM application for FIPS 140-3, and the challenges of FIPS-compliant email protection. These concrete examples made clear that standards, laboratory methods, and real product architectures must evolve together.
Running alongside the deep dive, the Beginner Training Track offered a different but equally important contribution: making the fundamentals usable. Swapneela Unkule explained the FIPS 140-3 validation lifecycle and showed how early assumptions about module boundaries, production builds, and evidence can create avoidable rework. Alessandro Fazio covered message authentication and digital signatures; Francesco Paolo D’Erme examined key derivation functions and changing security requirements; and Joachim Vandersmissen addressed sensitive security parameters and self-tests. Greg Burlea demonstrated ways to simplify cryptographic algorithm testing with ACVT Mate, while Renaudt Nuñez translated physical security requirements into practical choices appropriate to a module’s intended validation level.
Together, the tracks served participants at different stages of their FIPS journeys: one group grappled with how assurance should change; another built the foundations for doing assurance well today. Both shared the same underlying purpose: turning complex requirements and emerging ideas into better security practice.
Made possible by a community that cares
An inaugural conference does not come together through technical ambition alone; it takes organizations willing to contribute facilities, expertise, resources, and time—and individuals who believe that an open exchange of knowledge benefits everyone.
We extend our sincere gratitude to the University of Texas at Austin, our conference collaborator, for its partnership and support, and we are also deeply grateful to the organizations that made our three conference venues available. Their generosity helped make the event accessible to a wider community, including students and early-career participants.
Our heartfelt thanks go to our conference sponsors, listed in alphabetical order:
atsec · AWS · Brightsight by SGS · Chainguard · Crypto4A · Google Cloud · Marvell · Qualcomm
Their support helped turn a vision into a gathering where experts and newcomers could learn from one another. We also thank the speakers, panelists, moderators, reviewers, volunteers, and everyone who worked behind the scenes. FIPS ’n’ Chips was a community effort in the fullest sense.
Celebrating achievements, sharing stories, and having fun
The conference was not only about the next technical challenge, but also an opportunity to recognize the people and milestones that deserve to be celebrated.
A special book celebration honored the contributors to Tasting Cryptography, a collaborative effort to make cryptographic knowledge more approachable. The conference also recognized CMVP’s achievement of a zero review-pending queue, along with vendors receiving FIPS 140-3 certificates and testing professionals who had earned Cryptographic Validation Program (CVP) qualifications. Behind each milestone lie countless hours of engineering, testing, review, and persistence.
And while cryptographic assurance is serious work, FIPS ’n’ Chips made room for humor. Three animated clips enlivened the program: an introduction to Kevin Stine, a creative lead-in to “When AI Meets Cybersecurity,” and a celebration of the CMVP zero-queue milestone. A randomly generated show about entropy brought an especially fitting dose of unpredictability to the stage to close out the plenary sessions.
Conversations continued beyond the auditorium, with a reception dinner to welcome speakers, panelists, sponsors, and special guests, and a Texas BBQ networking dinner bringing participants together around good food and lively exchanges. At the end of the conference, “chip snacking time” gave everyone one more chance to trade ideas, catch up with new friends, and enjoy a final taste of FIPS ’n’ Chips.
More than breaks between presentations, these moments created space for introductions that became conversations, conversations that may become collaborations, and the laughter that makes a community feel like a community. We hope those connections will last well beyond Austin.
The conference ends, but the journey continues
The final session may be over, but the work of sharing what we learned has only begun. Preparation is underway for the FIPS ’n’ Chips 2026 conference proceedings to be published by Springer in its Advances in Computer Science Applications and Research (ACSAR) series. We look forward to extending the reach of the conference’s technical contributions to readers who could not join us in Austin.
A reminder to all speakers: please submit your full camera-ready papers by November 16, 2026.
To everyone who attended, we would love your feedback. What worked especially well? What should we improve? Which topics should we explore next? The Crypto-V Alliance Board of Directors and the FIPS ’n’ Chips Program Committee value your suggestions as we plan to make next year’s conference even better.
Please complete the attendee survey: https://tally.so/r/labBVv
For those who missed the conference—or would like to revisit the presentations—virtual registration will remain open for latecomers to purchase access to the slides and conference videos and receive information about future events.
To everyone who spoke, listened, volunteered, sponsored, hosted, organized, or simply started a conversation: thank you for making our first FIPS ’n’ Chips a success. We hope you traveled home safely, carrying new ideas, new connections, good memories, and perhaps a few tasty chips.
The chips may be gone, but the conversations are just getting started. We hope to see you back for more FIPS ’n’ Chips in 2027!
