I take it that the next proposal after "allowing replay attacks" would be to change the MUST in RFC2401 with respect to support for volume based lifetime since that value would experience as much contention as the replay counter. -dave