ipsec: keep crypto data inside SA