Ben, You're right! We will modify the AH and ESP specs to note that an SPI uniquely identifies an SA on a per destination AND per security protocol basis. Thanks for picking up on that inconsistency. Steve