Editing NSA encryption systems (section)

=== Internet ===

NSA has approved a variety of devices for securing [[Internet Protocol]] communications. These have been used to secure the Secret Internet Protocol Router Network ([[SIPRNet]]), among other uses.

The first commercial network layer encryption device was the Motorola Network Encryption System (NES). The system used the SP3 and KMP protocols defined by the NSA [[Secure Data Network System]] (SDNS) and were the direct precursors to [[IPsec]]. The NES was built in a three part architecture that used a small cryptographic security kernel to separate the trusted and untrusted network protocol stacks.<ref>{{cite web |url=https://patents.google.com/patent/EP0435094B1 |title = EP0435094B1 - Uniform interface for cryptographic services - Google Patents}}</ref>

The SDNS program defined a Message Security Protocol (MSP) that was built on the use X.509 defined certificates. The first NSA hardware built for this application was the BBN Safekeeper.<ref>{{cite book|author=Nancy Cox|title=Electronic Messaging|url=https://books.google.com/books?id=BJVwSRGkDZMC&pg=PA566|year=1999|publisher=CRC Press|isbn=978-0-8493-9825-4|page=566}}</ref> The Message Security Protocol was a successor to the IETF Privacy Enhance Mail (PEM) protocol. The BBN Safekeeper provided a high degree of tamper resistance and was one of the first devices used by commercial PKI companies.