Ran makes a good point about manual key management. The SPI (I still do not like that name) bit and byte ordering must be specified so that the identifiers can be matched with the IPSP PDU field. This is a simple thing to specify, and it does not impact implementations very much either. Russ