In your previous mail you wrote: The problem, then, of course, is that you've just made it near impossible to make a system which works in the generic "I want to establish an SA with some I've never heard of before" mode. => note this was the main argument against the full IPsec security solution of Mobile IPv6... Regards Francis.Dupont@enst-bretagne.fr