Properties
In good environment
- A,B see same sequence of messages with/without Encryption service
In intercepting environment
- A,B see subsequence of messages sent
with / without Encryption
- with Encryption, I sees message but not contents
- need fault-tolerance service
In faking environment
- there is junk mail -- need shared secret to detect