NORC: Why Organizations Need a New Approach to Secure Communication
In a world where data breaches make headlines daily and quantum computers threaten to break today’s encryption, organizations face a critical challenge: How do you enable secure collaboration across different companies, governments, and partners without compromising security or creating operational nightmares?
Current solutions force you to choose between security and collaboration. NORC (NavaTron Open Real-time Communication) is the first protocol designed specifically to solve this problem.
What is NORC?
NORC is a secure communication protocol built for organizations that need both ironclad security and practical federation. Think of it as the next evolution beyond Signal (secure but centralized) and Matrix (federated but complex) - combining the best of both worlds while preparing for the post-quantum future.
Key Innovation: NORC uses “graduated trust levels” instead of the traditional all-or-nothing approach to federation. You can communicate securely with:
- Basic partners (standard business relationships)
- Verified partners (higher assurance requirements)
- Classified partners (government/defense contractors)
- NATO-level partners (international security cooperation)
Each level has different security requirements and capabilities, giving you granular control over who you trust and how much.
Why Does NORC Exist?
The Current Problem
Existing secure communication protocols fail organizations in three critical ways:
Security vs Federation Trade-off: Signal is incredibly secure but only works within one company. Matrix enables federation but makes security optional, creating vulnerabilities.
Maintenance Nightmare: Protocols like TLS and Matrix accumulate decades of backward compatibility requirements, making them increasingly complex and vulnerable.
Quantum Vulnerability: Most current protocols will be broken by quantum computers, which may arrive sooner than expected. Organizations need protection against “harvest now, decrypt later” attacks happening today.
The NORC Solution
NORC solves these problems through four key innovations:
🛡️ Security-First Design: Every message is encrypted end-to-end by default. No optional security, no plaintext fallbacks, no exceptions.
🤝 Smart Federation: Organizations can federate selectively based on verified trust relationships rather than hoping everyone plays nice.
🔄 Bounded Complexity: NORC only supports adjacent major versions (N ↔ N+1), preventing the complexity explosion that kills other protocols.
🔮 Quantum Ready: Built-in hybrid post-quantum cryptography protects against both current and future threats.
Who is NORC For?
NORC is designed for organizations that can’t compromise on security:
Defense and Government
- Multi-national cooperation (NATO, Five Eyes, allied defense contractors)
- Classified information sharing with cryptographic audit trails
- Supply chain coordination across security-cleared vendors
- Diplomatic communications requiring both security and deniability
Enterprise and Critical Infrastructure
- Financial institutions sharing threat intelligence
- Healthcare systems collaborating on patient care across organizations
- Energy companies coordinating grid operations and incident response
- Technology companies with sensitive IP and customer data
Why Not Just Use Signal or Teams?
- Signal: Perfect for individuals and small teams, but doesn’t scale to multi-organization collaboration
- Microsoft Teams: Great for business, but no on-premises installation, you need to trust Microsoft
- Slack/Discord: Designed for convenience, not security
- Matrix: Federation-capable but security is optional and implementation is complex
What Problems Does NORC Solve?
1. The Federation Security Problem
Traditional Approach: “Trust everyone or trust no one”
- Matrix: Anyone can join, security is optional
- Signal: Only works within one organization
NORC’s Approach: “Trust selectively with cryptographic verification”
- Organizations explicitly negotiate trust relationships
- Each level has different security requirements
- Trust can be instantly revoked with cryptographic proof
- All decisions are recorded in tamper-evident audit logs
2. The Complexity Time Bomb
The Problem: Every protocol eventually becomes unmaintainable
- TLS supports ancient SSL versions vulnerable to attacks
- Email protocols carry 40+ years of legacy extensions
- Matrix rooms can have incompatible encryption settings
NORC’s Solution: Adjacent-Major Compatibility (AMC)
- Only support 2 versions at once (current + next OR current + previous)
- Forces regular upgrades but prevents breaking changes
- Predictable migration timelines for IT departments
- Bounded testing and security analysis requirements
3. The Quantum Computing Threat
The Reality: Quantum computers that can break current encryption are coming
- Could happen in 10-30 years (experts disagree on timeline)
- “Harvest now, decrypt later” attacks are happening TODAY
- Most organizations have no quantum-resistant strategy
NORC’s Approach: Hybrid cryptography from day one
- Combines classical encryption (secure today) with post-quantum (secure tomorrow)
- If either approach is broken, your data stays protected
- Gradual transition as quantum threats become real
- No painful migration when quantum computers arrive
How Does NORC Work?
Three-Layer Architecture
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ NORC-T │ │ NORC-F │ │ NORC-C │
│ Trust Management│◄─┤ Federation Layer│◄─┤ Client-Server │
│ │ │ │ │ Communication │
│ • Trust levels │ │ • Message relay │ │ • Device auth │
│ • Verification │ │ • Trust enforce │ │ • E2E messaging │
│ • Revocation │ │ • Load balance │ │ • File transfer │
│ • Audit trails │ │ • Performance │ │ • Presence │
└─────────────────┘ └─────────────────┘ └─────────────────┘NORC-C (Client): Your apps and devices - handles encryption, authentication, and user experience, NORC-F (Federation): Your servers - relay encrypted messages between organizations, NORC-T (Trust): The governance layer - manages who can talk to whom and at what security level.
Security Features That Actually Matter
Device-Level Security: Every device has its own encryption keys
- Lost phone? Only that device is compromised
- Employee leaves? Revoke only their devices
- Granular access control based on device trust
Metadata Protection: Servers can’t see what you’re sharing
- File names, sizes, and types are encrypted
- Message timing is randomized to prevent analysis
- Only encrypted blobs flow between organizations
Forward Secrecy: Past messages stay secure even if keys are stolen
- Each conversation uses ephemeral keys
- Keys are automatically deleted after use
- Compromise of today’s keys doesn’t affect yesterday’s messages
Audit Everything: Perfect for compliance and investigation
- Every trust decision is cryptographically recorded
- Message routing is logged without revealing content
- Tamper-evident audit trails for regulatory compliance
Why Another Protocol?
The Honest Answer: Because None of the Existing Ones Work for Organizations
Signal Protocol: Brilliant cryptography, wrong architecture
- Built for consumer messaging apps
- Centralized design doesn’t support federation
- No enterprise governance features
Matrix Protocol: Right idea, execution problems
- Security is optional (most deployments are insecure)
- Complexity grows without bound (operational nightmare)
- Federation is trust-everyone-or-no-one
TLS + Application Layer: The current enterprise approach
- Every app rolls its own security (inconsistent, usually wrong)
- No standardized federation between different systems
- Compliance features bolted on as afterthoughts
NORC’s Advantage: Purpose-built for organizational security needs
- Federation designed into the protocol from day one
- Security is mandatory, not optional
- Governance and compliance features are built-in, not add-ons
- Predictable complexity through version management
What’s Next?
NORC is currently in active development with implementations in Erlang/OTP (reference) and Rust (performance-focused). The protocol specifications are open source under Apache-2.0 license.
For Security Architects
- Review the technical specifications and provide feedback
- Consider NORC for new secure communication projects
- Engage with the community on cryptographic design and threat modeling
For Organizations
- Evaluate NORC for future secure collaboration requirements
- Participate in early adopter programs and testing
- Contribute to compliance and governance requirements definition
For Researchers
- Formal verification of security properties using tools like Tamarin/ProVerif
- Performance optimization and scalability analysis
- Integration with other post-quantum cryptography research
The Bottom Line
NORC exists because organizations need secure communication that actually works in the real world.
You shouldn’t have to choose between security and collaboration. You shouldn’t have to manage increasingly complex legacy protocols. You shouldn’t have to rebuild your entire infrastructure when quantum computers arrive.
NORC is designed to be the communication protocol your organization will still be using in 2040 - secure, federated, maintainable, and quantum-resistant.
The future of organizational communication will be determined by the protocols we build today. NORC aims to be one of them.
Want to learn more? Check out the NORC Protocol Specification, join our research community, or contact the team about early access programs.