Hidden assumptions in cryptographic protocols

It is shown that some well known cryptographic protocols for authentication are insecure if the underlying cryptographic algorithm does not avoid certain special features. Explicit assumptions based on the fundamental properties of cryptographic transformations are recommended as a basis for cryptographic protocol design. It is shown how these properties may be used to design alternative forms of the protocols analysed.