Note 50
The PLI was the first NSA-approved packet network encryption device. The project began in 1975, with follow-on enhancements for 2 more years. It was not an Internet capable system; it worked on ARPAnet traffic. It allowed insertion of an NSA-approved encryption device between the data source/sink and the PLI (the PLI was the ARPAnet Host).
Bob Bressler remembers, "The fundamental premise [of the PLI] was that the message could be broken into two parts—the header and the data. Transmitting the header in the clear was necessary to enable the network to correctly route the packets, but the data was encrypted. The packets were padded out to maximum length before encryption to prevent the length of the message being used as a signaling mechanism. This scheme was designed for point-to-point use [across the network], so the encryption schemes [at each end of the 'circuit'] could be synchronized in an off-line, out-of-band manner. Special hardware was used to connect the 'red' side of the PLI to the encryption box to the 'black' side. The special hardware split the header from the data and bypassed the encryption for the header. The 'bypass' was intentionally bandwidth limited to prevent that path being used to inadvertently pass data."
Bob Bressler remembers, "The fundamental premise [of the PLI] was that the message could be broken into two parts—the header and the data. Transmitting the header in the clear was necessary to enable the network to correctly route the packets, but the data was encrypted. The packets were padded out to maximum length before encryption to prevent the length of the message being used as a signaling mechanism. This scheme was designed for point-to-point use [across the network], so the encryption schemes [at each end of the 'circuit'] could be synchronized in an off-line, out-of-band manner. Special hardware was used to connect the 'red' side of the PLI to the encryption box to the 'black' side. The special hardware split the header from the data and bypassed the encryption for the header. The 'bypass' was intentionally bandwidth limited to prevent that path being used to inadvertently pass data."
