The IPSEC mechanism by which the management of authentication and encryption algorithms and their keys are decoupled from the suite of IPSEC protocols. A bidirectional communications session (A<->B) will normally have one Security Association (SA) for each direction - one for A->B traffic, and another for B->A traffic. The SPI, a 32-bit number contained in the packet, identifies the SA, and, hence, the algorithms and keys to be used in the processing of the packet.