Webex Recording and Summary:

Anton Notes:

Overview:

The meeting primarily focused on updates and planning around the upcoming OpenSSL conference, outreach efforts within the large business community, future plans for deprecated APIs, the future of OpenSSL’s LTS versions including post-quantum cryptography (PQC) support, and broader security topics such as AI-generated code and entropy requirements in FIPS validation. A few logistical and community outreach efforts, such as an upcoming visit to RTP (Research Triangle Park) and participation in local events, were also discussed.

1. Community Outreach & Meeting Growth

- Anton shared that he has spoken to 20–30 large business clients over the past 1.5 months to raise awareness about the call and the OpenSSL community. He invited them to join the meeting but did not send reminders.

- He expressed a desire to continue expanding the reach of the community and committed to re-following up with contacts who previously expressed interest.

- William from Juniper joined the call for the first time, having previously participated in a Juniper-OpenSSL call.

2. Upcoming OpenSSL Conference

- The conference is scheduled to happen in about three weeks.

- Almost all speakers have registered.

- The current registration count is 200 people, with 100 more yet to register, aiming for a target of 400.

- OpenSSL is offering attendance support, which may include funding and group discounts for clients.

- Anton stressed the goal of having at least one person from each client company attend.

- William confirmed that he and his team are scheduled to give a talk on Friday, outlining their upgrade journey from OpenSSL 1.1.1 to 3.x and associated performance issues and mitigations.

3. OpenSSL Headquarters Established

- The OpenSSL Corporation now has a physical office based in Brno, Czech Republic, with about 12 employees based there.

- The growth of the corporation was noted — from around 4–5 people pre-2022 to 17 employees and 3 contractors today.

- The office's grand opening included a small photo archive that may be shared publicly.

4. Removal of Deprecated APIs

- The OpenSSL team is planning a phased and cautious approach to removing deprecated APIs in OpenSSL 4.0, targeted for April.

- The first focus will be on deprecated engine-related APIs.

- To avoid breakages, stubs may be used to maintain application compatibility.

- Previous polling of the community regarding deprecated APIs was deemed non-representative (12–13% response rate), prompting a more careful and specific follow-up.

- OpenSSL aims to collect further feedback from the community using targeted proposals.

- Participants supported the idea in general but stressed the need for proper evaluation of their internal codebases and dry-run builds to detect dependencies.

5. Build Testing Collaborations

- Anton suggested collaborating with AWS to use their build infrastructure (specifically referencing AWS-LC and its SCI test structure) to simulate the effect of removing deprecated APIs.

- Panos (from AWS) indicated it's possible to run dry-run builds without committing the changes and volunteered Craig Lorentzen's team (from AWS) as a potential point of contact for the initiative.

6. Post-Quantum Cryptography (PQC) & LTS Strategy

- OpenSSL 3.5 and 3.6 support some aspects of PQC like LMS and XMSS (signature verification).

- Anton stressed the importance of encouraging companies to migrate to 3.5 LTS for post-quantum readiness.

- Discussion about FrodoKEM, ML-KEM, and HQC occurred — FrodoKEM being favored by BSI (German cert authority), but its lack of final standardization was a concern.

- Panos noted that cryptographic politics are involved and OpenSSL should be cautious about introducing algorithms too early without adoption consensus or standardized backing.

7. FIPS Certification & Module Boundaries

- Topic raised regarding changes in FIPS certification (e.g., possibly requiring entropy sources within cryptographic module boundaries).

- Consensus voiced that this requirement could compromise the modular approach commonly used in FIPS validation.

- Further guidance may be needed from NIST or CMUF working groups.

8. Recommended and Default PQC Algorithms in TLS 1.3

- Discussion on how OpenSSL should define or recommend default PQC groups in TLS 1.3.

- The current consensus (in the TAC) is to document the defaults but not make performance-based or directional recommendations at this time.

- Panos expressed a personal preference order based on quantum resistance and performance but noted he doesn’t expect OpenSSL to enforce anything.

9. Governance: AI Policy for Open Source Contributions

- Raised by James (not on this call), the question of whether OpenSSL should adopt a formal AI-generated code policy was introduced.

- Discussion acknowledged the growing importance of the topic but also noted the challenge of enforcement and scope.

- There was agreement it’s a complex issue requiring further thought and stakeholder input.

- Anton suggested that the community should first clarify the concern and scope before formulating a policy.

- The idea of hosting a dedicated session on AI code policy during the OpenSSL conference was proposed.

10. RTP Visit – November Activities

- OpenSSL representatives will visit North Carolina in November for a week-long series of events post-conference.

- Key event to attend is the “All Things Open” community meet-up, with OpenSSL acting as a featured participant in an evening forum.

- Cisco and NetApp will also host parts of the agenda.

11. Additional Technical Contributions & Algorithm Additions

- Panos briefly mentioned interest in new non-post-quantum primitives (e.g., HPKE with ML-KEM) as candidates for inclusion in future versions.

- HPKE support in OpenSSL currently uses only ECDH; extending HPKE to post-quantum groups like ML-KEM is under consideration.

- Further discussions to happen in private meetings during RTP week.

Conclusion:

The meeting concluded with thanks and encouragement for stronger engagement in future business community meetings. The upcoming OpenSSL conference, the RTP outreach week, and follow-ups on technical topics (API deprecation, PQC, AI policy, future cryptographic support) are focal points moving forward. Anton emphasized more effective advocacy and consistent communication with large business clients.

End of Meeting.