Abstract
We develop an approach to deriving concrete engineering advice for cryptographic protocols from provable-security-style proofs of security. The approach is illustrated with a simple, yet useful protocol. The proof is novel and is the first published proof that provides an exact relationship between a high-level protocol and multiple cryptographic primitives.