Port 558: SDNSKMP — The forgotten precursor to modern Internet security

Port 558 carries SDNSKMP—the Secure Data Network System Key Management Protocol. If you have never heard of it, you are not alone. This port belongs to a piece of Internet history that did its job and then disappeared.

What SDNSKMP Is

SDNSKMP is a key management protocol developed by the National Security Agency as part of the Secure Data Network System (SDNS) program, which ran from 1986 to 1991.¹ The protocol's job was to generate, distribute, and update encryption keys across a network—the fundamental problem that any secure communication system must solve.

You cannot encrypt traffic without keys. You cannot share keys safely without a protocol. SDNSKMP was the NSA's answer to this problem, built on the ISO OSI networking model that everyone thought would dominate the Internet.²

The SDNS Program

The Secure Data Network System was the NSA's attempt to build security into computer networking from the ground up. Rather than bolting encryption onto existing protocols, SDNS defined secure versions of multiple network layers—network layer (layer 3), transport layer (layer 4), and application layer security including email.³

Key management was central to everything. The SDNS Key Management Protocol handled distributing symmetric keys to lower-layer security protocols. It used ASN.1 encoding—the same abstract syntax notation that X.509 certificates use—to define its message formats.⁴

The program was surprisingly open for an NSA project. Starting around 1988, much of the SDNS work was publicly published. NIST released internal reports documenting the protocols, the key management system, and the security architecture.⁵

What Happened to It

SDNS lost. The Internet standardized on TCP/IP, not OSI. When the security community needed encrypted networking, they built IPsec—which borrowed heavily from SDNS concepts but adapted them to the IP world that actually existed.⁶

The SDNS Key Management Protocol influenced ISAKMP (Internet Security Association and Key Management Protocol), which became part of the IPsec suite. The ideas lived on. The specific protocol did not.

Port 558 remains assigned to SDNSKMP in the IANA registry,⁷ but you will not find anything listening there. The protocol is a historical artifact—important for what it taught the people who built the security systems we actually use, irrelevant for anyone configuring a network today.

Why This Port Matters

Port 558 is a reminder that the Internet's current security architecture is not the only way things could have gone. In a parallel timeline where OSI won and TCP/IP lost, SDNSKMP might be as ubiquitous as TLS.

The real contribution was not the specific protocol. It was proving that automated key management could work at scale, that you could build security into network layers rather than just application layers, and that even classified agencies could publish their cryptographic protocols for public review without the sky falling.

Every VPN connection you make, every IPsec tunnel, every IKE key exchange—they all contain echoes of the ideas that SDNS pioneered. Port 558 is where those ideas once lived.

Checking Port 558

On Linux or macOS, you can check if anything is listening on port 558:

sudo lsof -i :558
sudo netstat -an | grep 558

On Windows:

netstat -an | findstr :558

You will almost certainly find nothing. This port belongs to history.

Related Ports

• Port 500: ISAKMP/IKE—the IPsec key management protocol that succeeded SDNS-KMP's ideas
• Port 4500: IPsec NAT traversal—modern VPNs in action
• Port 443: HTTPS—the application-layer security that won while SDNS was building network-layer security