"responder SPI as a hash of the initiator's SPI"? Which initiator? phase 1 initiator? phase 2 initiator? When a rekey occurs, the initiator and responder roles can be swapped. - Bill