¨Both peers generate new DH shared secret = (Xb`)a mod p  = (Xa`)b mod p ¨Both peers generate shared session keys for incoming and outgoing IPsec SAs based on SKEYID_d, new DH shared secret, SPI, and Ni` and Nr`