> - The use of birth certificates effectively requires continuous channel mode > as well. (Or at least it requires you to remember a large portion of the > information in the phase 1 SA, such as the peer's identity & public > key.) If you don't remember the authenticated identity, sessions will be vulnerable to hijacking by a different principal at rekey time. - Bill