In IPSec, why does it make sense to differentiate between Security Associations and Security policies?
I always liked that definition from tcpipguide
The former says that if you see a packet that looks like it has characteristics X do Y. The latter says that with this host we talk IPSec in this ways.
Might help if you think of it as stateless and statefull, respectively.
An SA also can (should) have a lifetime such as number of packets, minutes etc. Before the SA expires, a new SA is created, using a new key negotiated by IKE.
The more cypher text encrypted using the same key increases the chance of a Ciphertext Only Attack
Also if the key is broken, only a portion of the traffic is compromised.