Paul, Most crypto modules today do not include this aspect of IPsec, although newer crypto chips that are IPsec specific may do so. Yes, an explicit IV approach for counter mode, where the crypto module is responsible for the IV, is fine. Steve