The Fortress Communicator security whitepaper is the long version of the Security & Encryption article — the same content written for auditors, security researchers, and procurement reviewers who need exact detail rather than plain-language summaries.
What is in the whitepaper
Roughly 40 pages, organized by trust boundary:
- Threat model — which adversaries we defend against and which we do not, in explicit terms.
- Cryptographic primitives — Curve25519 ECDH, AES-128-GCM AEAD, HKDF-SHA256, SHA-512 fingerprint derivation, with references to the IETF RFCs.
- Identity and device registration — how device keys are generated, stored, and registered server-side.
- Per-call key exchange — the NaCl box envelope that wraps each call’s encryption key.
- SFrame (RFC 9605) — the IETF-standard media encryption layer, including per-frame nonce construction and 30-second key ratcheting.
- Safety number verification — the 60-digit fingerprint, the server-side hash storage, and the trust record lifecycle.
- Conference calls — the per-epoch group key derivation and the 2-of-3 acknowledge-commit pattern.
- Fallback semantics — when calls drop from end-to-end mode and how the UI tells the user.
- PSTN and mixed-cohort calls — why these cannot be end-to-end encrypted and how the orange band is rendered.
- Honest limitations — what we do not defend, written plainly.
Who should read it
- Procurement reviewers evaluating Fortress for an enterprise deployment.
- Security researchers testing the trust boundary claims.
- Technical buyers who want to understand exactly what they are buying, not the marketing version.
- Anyone curious about how modern voice encryption works and willing to read an IETF-style document.
Version 2.0 · Classification: PUBLIC · approximately 40 pages.
Finally something with actual protocol-level detail instead of just marketing buzzwords — I forwarded this to our IT director immediately. We’ve been shopping for a secure messaging solution for inter-facility transfers and the ratcheting section answered a question our vendor couldn’t. Appreciate that you published the full RFC-style breakdown rather than a glossy one-pager.
Finally, a vendor willing to put the actual cryptographic architecture in writing instead of just saying ‘military-grade encryption’ and calling it a day. Downloading this now to pass along to our IT security team before our next contract review. Would be helpful to see a section addressing CJIS compliance mapping in a future version.
Finally downloaded this last night — the section on key exchange and ratcheting is more thorough than anything I’ve seen from our previous vendor. Forwarded it straight to our IT director before our contract renewal meeting. Appreciate that you didn’t dumb it down for a sales audience.
Finally something worth printing out and actually reading cover to cover. We’ve been getting pushed hard by vendors claiming ‘end-to-end encryption’ with zero documentation to back it up — having RFC-level detail on the key exchange and ratcheting protocol is exactly what our IT auditor has been asking for. Downloading this now for our next infrastructure review.
Finally something with actual technical depth instead of marketing fluff — our IT security guy has been asking for this kind of documentation before we even consider any new comms platform. Downloading now to pass along. Appreciate that you put the trust boundary section in there; that’s usually where these products fall apart under scrutiny.
Finally something with actual technical depth instead of a glossy sales sheet. Forwarding this to our IT director and county cybersecurity coordinator before our next JMS contract review. Appreciated the mention of trust boundaries specifically — that’s been a sticking point in our last two vendor conversations.