XFRM State Management API current keys: (family, daddr, spi, proto) not sufficient (especially for mobile ip) userland daemon need to add/delete with specific source address struct xfrm_usersa_id { xfrm_address_t daddr; __u32 spi; __u16 family; __u8 proto; xfrm_address_t saddr; // NEW }; This is probably good for xfrm6_tunnel management, too. We see "hashed" spi for xfrm6_tunnel. Mobile IP is a kind of tunnel, anyway.