\documentclass{article}

\usepackage{rcs}
\RCS$Date: 2026/02/23 18:44:35 $
\RCS$RCSfile: aspen-doc.ltx,v $
\RCS$Revision: 1.42 $
\RCS$State: Exp $
\RCS$Author: aa $

\edef\AADate{\RCSDate}
\edef\AARawDate{\RCSRawDate}
%\typeout{XXX: \AARawDate}

\usepackage[T1]{fontenc}
\usepackage[utf8]{inputenc}

\usepackage[color,ban=aa]{aspen}

\usepackage[charter,expert]{mathdesign}
\usepackage[scaled=.96,osf]{XCharter}% matches the size used in math
\linespread{1.04}

\usepackage[a4paper,margin=3cm]{geometry}

\usepackage{graphicx}
\usepackage[dvipsnames,x11names]{xcolor}
\usepackage[most]{tcolorbox}
\usepackage{xltabular}
\usepackage{makecell}
%\usepackage{amssymb}
\usepackage{wasysym}
\usepackage{fancyvrb}
\usepackage{fvextra}
\usepackage{hologo}
\usepackage{comment}

% This is used for MetaPost figures in the text.  Some figures might
% use my two MetaPost packages aamisc and aaobj:
%   https://www.pg12.org/dist/texmf/mp/aaobj/
\usepackage{luamplib}
\everymplib{
verbatimtex
%&latex
\documentclass{article}
\usepackage[color,ban=aa]{aspen}
\usepackage[charter,expert]{mathdesign}
\usepackage[scaled=.96,osf]{XCharter}% matches the size used in math
\linespread{1.04}
\begin{document}
etex
input aamisc;
input aaobj;
numeric width, height, orad, v;
orad:=0.5cm;
width:=5orad; 
height:=3orad; 
v:=27;
pair p[], q[], c, d;
ahlength:=2.5;
beginfig(0); }
\everyendmplib{ endfig; }

\usepackage[hang,flushmargin]{footmisc}
\usepackage{caption}
\usepackage[numbib,nottoc]{tocbibind}

\usepackage{hyperref}
% \hypersetup{
%     colorlinks=true,
%     linkcolor=blue,
%     filecolor=magenta,      
%     urlcolor=cyan,
%     pdftitle={Overleaf Example},
%     pdfpagemode=FullScreen,
%     }

\parindent=0pt
\parskip=\bigskipamount
\renewenvironment{quotation}{\begin{quote}}{\end{quote}}
\topsep=0pt
\partopsep=0pt
\setcounter{tocdepth}{2}

%\usepackage{minted2}	% TEMP work-around: should be minted
%\usemintedstyle{manni}
%\usemintedstyle{autumn}

\makeatletter

\def\latex{L\kern -.29em{\sbox \z@ T\vbox to\ht \z@ {\hbox {\check@mathfonts \fontsize \sf@size \z@ \math@fontsfalse \selectfont A}\vss }}\kern -.12em\TeX}

\renewenvironment{quote}{%
  \list{}{\listparindent=0em
    %\itemindent=\listparindent
    %\leftmargin=\parindent
    \rightmargin=\leftmargin
    \topsep=0em
    \partopsep=0em
    \parsep\z@\@plus\p@}%
  \item\relax}{\endlist}

\makeatother

\colorlet{LightLightCyan}{LightCyan2!40!}
\colorlet{LightLightGrey}{gray!15!}
\colorlet{LightGrey}{gray!80!}
\colorlet{LightCyan}{cyan!80!}

\newcommand{\extxt}[1]{\textcolor{gray}{#1}}
\newcommand{\givesarrow}{\extxt{\ensuremath{\rightarrow}}}
\newcommand{\gives}{\ensuremath{\quad\givesarrow\quad}}
% \NewDocumentCommand{\cs}{mo}{%
%   \acmd{\textbackslash #1}%
%   \IfNoValueTF{#2}{}{\texttt{\{#2\}}}}
%\def\cs#1{\acmd{\textbackslash #1}}

%\newcommand{\imptxt}[1]{\textcolor{NavyBlue}{#1}}
%\newcommand{\impcmd}[1]{\imptxt{\texttt{#1}}}

% \tcbset{on line, 
%   boxsep=4pt,left=0pt,right=0pt,top=0pt,bottom=0pt,
%   colframe=white,colback=LightLightCyan,  
%   highlight math style={enhanced}}

\newtcbox{\exbox}{on line, 
  boxsep=4pt,left=0pt,right=0pt,top=-2pt,bottom=0pt,
  colframe=white,colback=LightLightGrey,  
  highlight math style={enhanced}}
\newtcbox{\shadedbox}{on line, 
  boxsep=0pt,left=0pt,right=0pt,top=0pt,bottom=4pt,
  colframe=white,colback=white,  
  highlight math style={enhanced}}
\newcommand{\example}[1]{\hspace*{\fill}\shadedbox{\exbox{\small \ensuremath{\begin{array}{c}#1\end{array}}}}\hspace*{\fill}}
%\DeclareRobustCommand\iff{\;\Longleftrightarrow\;}

% Inspired by the example environment in
% https://tug.ctan.org/macros/latex/contrib/minted/minted.dtx

\fvset{formatcom=\color{NavyBlue}}
\newlength{\codewith}

\newcommand\ttol[2]{\hyperlink{ttol:#1}{\emph{#2}}}
\newcommand\tableoflisting{%
  \begin{tabular}{@{\qquad}ll}
  \input{aspen-doc.tol}
  \end{tabular}\vspace*{-\baselineskip} % Compensate for last \\
  \newwrite\tolfile
  \immediate\openout\tolfile=\jobname.tol
}
\newcommand\tol[2]{%
  \hypertarget{ttol:#1}{\subsection*{#2}}%{\textbf{#2}~}
  \immediate\write\tolfile{\unexpanded{$\bullet$\quad\ttol}{#1}{#2} &
    {\unexpanded{\latex}} code: \unexpanded{\refltxcode}{#1}
    \unexpanded{\\}}}

\newwrite\locfile
\immediate\openout\locfile=\jobname.loc
\newenvironment{ltxcode}[2]{%
  % #1	label / file name
  % #2	Title / description
  \VerbatimEnvironment
  \def\lblfn{#1}%
  \def\locdesc{#2}%
  \begin{VerbatimOut}[gobble=2]{loc/#1.tex}}
  {\end{VerbatimOut}%
  \immediate\write\locfile{\unexpanded{\subsubsection}{\locdesc}}%
  \immediate\write\locfile{\unexpanded{\label}{loc:\lblfn}}%
  \immediate\write\locfile{\unexpanded{\VerbatimInput}{loc/\lblfn .tex}}%
  \immediate\write\locfile{\unexpanded{\glet\steplabel\eatit}}%
  \immediate\write\locfile{\unexpanded{\input}{loc/\lblfn .tex}}%
  \immediate\write\locfile{\unexpanded{\glet\steplabel\label}}}

\newcommand\useltxcode[1]{\input{loc/#1.tex}}
\newcommand\showltxcode[1]{\VerbatimInput{loc/#1.tex}}
\newcommand\refltxcode[1]{\ref{loc:#1}}
\newcommand\pagerefltxcode[1]{\pageref{loc:#1}}

\newenvironment{ltxex}[2]{%
  \VerbatimEnvironment
  \def\lfn{#1}%
  \def\ltitle{#2}%
  \begin{ltxcode}{#1}{#2}}
  {\end{ltxcode}%
  \qquad
  \begin{tabular}{@{\hskip 1pt\relax}l@{}}
    \emph{\ltitle} \\\hline
    \\[-1.3\medskipamount]
    \begin{tabular}{@{}l@{}}
      \useltxcode{\lfn}
    \end{tabular}
  \end{tabular}}

\newenvironment{ltxexample}[1]{%
  \setlength{\codewith}{#1}%
  \VerbatimEnvironment
  \begin{VerbatimOut}[gobble=2]{example.out}}
  {\end{VerbatimOut}%
   \begin{center}
   \fbox{%
     \begin{minipage}[c]{\codewith}%
       % \inputminted[resetmargins]{latex}{example.out}%
       \VerbatimInput{example.out}%
       \vspace*{-2ex}%	% The \fvset adds extra space (bug?)
     \end{minipage}%
     \vrule
     \input{example.out}\hspace{-0.5em}}%
   \end{center}}

\newenvironment{ltxexample*}[1]{%
  \setlength{\codewith}{#1}%
  \VerbatimEnvironment
  \begin{VerbatimOut}[gobble=2]{example.out}}
  {\end{VerbatimOut}%
  \begin{center}
    \fbox{%
      \begin{minipage}[c]{\codewith}%
        % \inputminted[resetmargins]{latex}{example.out}%
        \VerbatimInput{example.out}%
       \vspace*{-2ex}%	% The \fvset adds extra space (bug?)
      \end{minipage}}%
  \end{center}}

% \newcommand\cmdargs[2]{\acmd{\textbackslash\Verb|#1|}: \acmd{\Verb|#2|}}
\NewDocumentCommand\cmdargs{mmo}{%
  \acmd{\textbackslash\Verb|#1|}: \acmd{\Verb|#2|}%
  \IfValueT{#3}{\returns{\acmd{\Verb|#3|}}}}

\NewDocumentCommand\cmdmarg{m}{%
  \acmd{\{\emph{<#1>}\}}}
\NewDocumentCommand\cmdoarg{m}{%
  \acmd{[\emph{<#1>}]}}
\NewDocumentCommand\cmdparg{m}{%
  \acmd{(\emph{<#1>})}}
\NewDocumentCommand\cmdkarg{}{%
  \acmd{\emph{<T>}}}
\NewDocumentCommand\cmdsarg{}{%
  \acmd{\emph{<*>}}}
\NewDocumentCommand\cmdearg{}{%
  \acmd{\Verb|_|\{\emph{<marker>}\}}}
\NewDocumentCommand\cmdargexx{mm}{%
  \acmd{\emph{\textbackslash\Verb|#1|}#2}}
\NewDocumentCommand\cmdargex{mmo}{%
  \acmd{\textbackslash\Verb|#1|#2}%
  \IfValueT{#3}{\newline\returns{#3}}}

\DeclareFontFamily{U}{lasy}{}
\DeclareFontShape{U}{lasy}{m}{n}{
  <-5.5> lasy5
  <5.5-6.5> lasy6
  <6.5-7.5> lasy7
  <7.5-8.5> lasy8
  <8.5-9.5> lasy9
  <9.5-> lasy10
}{}
\DeclareFontShape{U}{lasy}{m}{b}{
  <-5.5> lasy5
  <5.5-6.5> lasy6
  <6.5-7.5> lasy7
  <7.5-8.5> lasy8
  <8.5-9.5> lasyb10
  <9.5-> lasyb10
}{}
\DeclareRobustCommand{\Leadsto}{%
  \mathrel{\text{\usefont{U}{lasy}{m}{b}\symbol{"3B}}}%
}
%\DeclareRobustCommand{\rLeadsto}{%
%  \mathrel{\text{\reflectbox{\usefont{U}{lasy}{m}{n}\symbol{"3B}}}}%
%}


\begin{document}

\title{{\aspen}\\[.5\baselineskip]
  A suggested security protocol notation}
\author{Anders Andersen\\[.3\baselineskip]
  UiT The Arctic University of Norway}
\date{\AARawDate\\[.2\baselineskip]
  (\acmd{aspen.sty} version \RCSRevision)}

\maketitle
\thispagestyle{empty}

In security literature, different notations for cryptographic values,
functions and protocols have been used and suggested.  Three often
cited references for such notations are ``Kerberos: An Authentication
Service for Open Network Systems''~\cite{steiner1988a}, ``Exploring
Kerberos, the Protocol for Distributed Security in Windows
2000''~\cite{chappell1999a}, and ``A Formal Semantics for Protocol
Narrations''~\cite{briais2005a}. The notation {\aspen} presented here
is strongly inspired by notations found in these three references,
notations found in text books~\cite{anderson2020a}, and the notation
used in my own publications, teaching and presentations.  {\aspen} is
closely related to what is often called ``security protocol
notation'', ``standard protocol engineering
notation''~\cite{anderson2001a,anderson2008a}, ``standard protocol
notation''~\cite{anderson2020a}, or ``protocol
narrations''~\cite{briais2005a}.

This text documents the {\aspen}\footnotemark{} notation and how this
notation can be used in {\latex} documents using the {\latex} package
\Verb|aspen|. Since the {\latex} package \Verb|aspen| optionally
provides support for the BAN logic notation, we have included the BAN
logic notation in the documentation.

\parbox[t]{.47\linewidth}{%
  The {\aspen} notation is \emph{not} a formalism, like BAN
  (Burrows–Abadi–Needham) logic~\cite{burrows1989a}, or a calculus for
  analysis of cryptographic protocols, like Spi
  calculus~\cite{abadi1999a}.  For a more detailed analysis of
  cryptographic protocols, more expressive notations like BAN logic,
  Spi calculus, or something similar should be considered. Other
  references presenting relevant notations include, but are not
  limited to: \cite{briais2007a,davis1989a,schafer2001a}.\\
  
  \hfil\begin{steps*}
    \send{A}{S}{\apri{A},\apri{B},\nonce{A}} \\
    \send*{S}{A}{\encrypted{A,S}{\nonce{A},\apri{B},\key{A,B},%
        \encrypted{B,S}{\key{A,B},\apri{A}}}} \\
    \send*{A}{B}{\encrypted{B,S}{\key{A,B},A}} \\
    \send*{B}{A}{\encrypted{A,B}{\nonce{B}}} \\
    \send*{A}{B}{\encrypted{A,B}{\nonce{B}-1}}
  \end{steps*}\hfil%\\[-1ex]
  \captionof{figure}{{\aspen} example (what protocol is it?)}}%
\hfil
\parbox[t]{.46\linewidth}{{\small
    \vspace*{-2\baselineskip}\tableofcontents}}

\footnotetext{{Originally, I had no intention to name the notation
  presented here. While working on this text, it became clear that it
  was inconvenient to not be able to refer to the notation with a
  short name. The name {\aspen} \emph{can} be an abbreviation for ``A
  Security Protocol Engineering Notation'', but for me it is now short
  for ``Anderson-inspired Standard Protocol Engineering Notation'', in
  memory of the late \href{https://www.cl.cam.ac.uk/archive/rja14/}%
  {Professor Ross J.\ Anderson} who has meant so much for the fields
  of computer security, distributed systems, and, in particular,
  \href{https://www.cl.cam.ac.uk/archive/rja14/book.html}{security
    engineering}~\cite{anderson2001a,anderson2008a,anderson2020a}.}}

\clearpage
\section{Introduction}
\label{sec:intro}

\begin{figure}
  {\renewcommand{\arraystretch}{1.2}
  \begin{xltabular}{\textwidth}{llX}
    Values:
    & \atrue, \sval{m}, \chash{m}
    & Values, structured values and typed structured values. In this
      notation a message is seen as a structured value. 
    \\
    Principals:
    & \apri{A}, \apri{B}, \apri{S}
    & Principals in security protocols, including clients,
      servers, and other participants.
    \\
    Keys:
    & \key{A,B}, \key'{C,S}, \key+{A}, \key-{B} 
    & Cryptographic keys, used to encrypt, decrypt, sign and verify
      values and messages.
    \\
    Nonces:
    & \nonce{A}, \nonce{B}, \nonce{S} 
    & Nonces are generated to be fresh and commonly
      include a timestamp or a number that is used only once.
    \\
    Counter:
    & \counter{A}, \counter[C]{B}
    & Counter or indexes can be used to identify a session or a number
      in a sequence.
    \\
    Random:
    & \random{x}, \random'{1}
    & Random values can be a variant of nonces.  The $\smark$ mark hints
      about limited useful lifetime (once, or during a session).
    \\
    Time:
    & \ats{T_S}, \ats{T_A}, \attl{L} 
    & Timestamps and lifetime are often used, together with nonces,
      to avoid replay and session keys that are too old.
    \\
    Strings:
    & \astr{Hello world!}
    & Not necessary for the intended notation usage, but text strings 
      are often found in examples in the literature.
    \\
    Variables:
    & \avar{x}, \avar{y}, \avar{z}, \avar{a}, \avar{b}, \avar{c}
    & A variable can be assigned a value. Might also be used in the
      context of ``we are not sure about its value''.
    \\
    Functions:
    & \chashf{m}, \func{Func}{\avar{x},\avar{y}}\ret\avar{z} 
    & A function can take arguments and produce a value. Some functions
      are the constructor of typed structured values.
    \\
    Labels:
    & \alabel{M_1}, \alabel{S_1}
    & Labels are used to label steps when a security protocols is
      presented as a series of steps.
    \\
    {\latex} code:
    & \acmd{\Verb|\func{Func}{x,y}|}
    & {\latex} code is shown when documenting the usage of the notation
      in text using the {\latex} package \acmd{aspen}.
  \end{xltabular}\vspace*{\baselineskip}}
  \caption{In the text, color is used to distinguish different features.}
  \label{fig:col}
\end{figure}

%\kkey{A}, \kkey*{A}, \kkey-{A}, \kkey+{A}, \kkey!{A}, \kkey'{A}, \kkey"{A},
%\key{B}, \key*{B}, \key-{B}, \key+{B}, \key!{B}, \key'{B}, \key"{B},
%\mkfunc{MyTest}[chash]
%|\funcMyTest{x}[*]|
%|\chashf{m}[*]|
%\mkkfunc{MyK}[encrypted]
%|\funcMyK{x}{y}[*]|
%|\encrypt+{A}{m}[*]| |\pwkeyf{P}(s)[P]| |\pwkeyf{P}(s)[*]|
%|\encrypted{x}{m}|
%|\macf{A}{m}[*]| |\cmacf{A}{m}[*]| |\hmacf{A}{m}[*]|
%|\sigf-{A}{m}[*]| |\sign!{A}{m}[*]|

Why {\aspen} then? One motivation is to have an expressive notation
that can be used in publications where security protocols are
presented. Another motivation is to have a notation that can be used
when teaching security related topics. This text is an attempt to
document a notation that have been used and refined over years. The
notation should be familiar, but with some new useful refinements and
contributions not found in similar notations. It should also be
possible to use the notation together with other notations, like BAN
logic.  A more detailed discussion on the choices made for the
{\aspen} notation is found in Appendix~\ref{sec:notes-notation},
\emph{\nameref{sec:notes-notation}}.  The {\latex} package can be
downloaded from \href{https://ctan.org/pkg/aspen}{CTAN} or its home:
\begin{quote}
  \href{https://www.pg12.org/dist/texmf/tex/latex/aspen/}%
  {\acmd{https://www.pg12.org/dist/texmf/tex/latex/aspen/}}
\end{quote}

When using {\aspen}, colors can be used to distinguish different types
of features. Figure~\ref{fig:col} illustrates how the different
features are colored.  Colors are optional when using the
notation. They are enabled by the \acmd{color} option to the {\latex}
package \acmd{aspen}. Colors are only added for readability.  The
{\latex} package \acmd{aspen} provides different color profiles for
typesetting the notation (see Appendix~\ref{sec:notes-options},
\emph{\nameref{sec:notes-options}}).

If the \acmd{aspen} package is loaded with the option
\acmd{ban}, the BAN logic notation from ``A Logic of
Authentication»~\cite{burrows1989a} is included (see
Section~\ref{sec:notation-ban} and~\ref{sec:latex-ban}).


\clearpage
\section{The notation}
\label{sec:notation}

In the description of the notation below, notation that might be
obvious is included.  It is done for completeness and consistency.
For some notation constructs, usage examples are provided.  These
examples might include notation constructs explained later in the
text.

\subsection{{\aspen}}
\label{sec:notation-aspen}



{\renewcommand{\arraystretch}{1.6}
  \begin{xltabular}{\textwidth}{lX}\Xhline{0.5pt}

    \textbf{Notation}
    & \textbf{Description} \\\Xhline{0.5pt}

    $=,<,\leq,>,\geq$
    & $=$ means \emph{``is equal''}, either as a statement or a claim
      (e.g.,~a claim that can be, or has to be, verified). $<$, $\leq$, $>$
      and $\geq$ means \emph{``less than''}, \emph{``less than or equal''},
      \emph{``greather than''}, and \emph{``greather than or equal''},
      respectively. These notation constructs are typically used to
      compare counters and timestamps in protocols.
    \\\hline
  
    $\!\axor\!,\aconcat$
    & The binary operator $\axor$ is exclusive or, and the binary operator
      $\aconcat$ is concatenation (used to concatenate two values or strings).
      The concatenation operator has precedence over the exclusive or operator.
      In Section \ref{sec:notes-options}, other options for the binary
      concatenation operator is presented.
    \\\hline

    $\aifthen,\aiffthen$
    & $\avar{x}\aifthen\avar{y}$ means \emph{``\avar{y}, if~\avar{x}''}.
      $\avar{x}\aiffthen\avar{y}$ means \emph{``\avar{y}, if and only
      if~\avar{x}''}.  This is an example used with the
      \afname{\verifytext} function (see  below for the description of
      other parts of the notation used in the example):
      \newline
      \example{\verify+[big]{A}{\signed{x}{m}} = \atrue \enspace
      \aiffthen \enspace \key{x} = \privkey{A}}
    \\\hline
    
    $\avar{x}\leadsto\avar{y}$
    & We use a leads-to arrow $\leadsto$ to show more
      details or to unpack a value or a message. The following example
      shows that a digital signature is actually a cryptographic hash
      value of the message encrypted with a private key (see below for the
      description of other parts of the notation used in the example):
      \newline
      \example{\sig-{A}{m}\leadsto\encrypted-[big]{A}{\chash{m}}}
    \\\hline
                  
    \atrue, \afalse
    & The boolean values \emph{true} and
      \emph{false}.  The value {\atrue} will also be used to show that 
      an operation completed with success (if that is important). For 
      example, when we verify a digital signature and it is found valid, the
      function doing the verification returns the value {\atrue}.
      Otherwise, the value {\afalse} is returned.
    \\\hline
  
    \key{X}
    & A shared or secret key, also known as a symmetric encryption and
      decryption key.
    \\\hline

    \key{A,B}
    & A shared key for \apri{A} and \apri{B} (this notation can be
      extended, for example with \key{A,B,C} for a key shared between
      \apri{A}, \apri{B}, and \apri{C}, or \key{\agroup{M}} for a
      key shared among $n$ group members \agroup*{M}).
    \\\hline
    
    \key'{C,S}
    & A session key for \apri{C} and \apri{S} (this notation can be
      extended, for example with \key'{A,B,S} for a key session key
      shared between \apri{A}, \apri{B}, and \apri{S}, or \key'{\agroup{M}}
      for a session key shared among $n$ group members \agroup*{M}).
    \\\hline
    
    \key+{A}
    & The public key of a public-private key pair of \apri{A}:
      $(\key+{A},\key-{A})$.
    \\\hline
    
    \key-{A}
    & The private key of a public-private key pair of \apri{A}:
      $(\key+{A},\key-{A})$.
    \\\hline

    \pwkey{P}
    & A secret key generated from the password \aval{P}.
    \\\hline

    \sval{m}
    & A structured value or message containing \aval{m}. A structured value
      can be nested.
    \\\hline
    
    \tval{\extxt{t}}{m}
    & A structured value or message with the type $\extxt{t}$. An example
      of a structured value marked with the type \aval{\textit{Sig}}:
      \newline
      \example{\sig!{A}{m}\mbox{ has the type \emph{\aval{\textit{\sigtext}}}
      and the superscript }\aname{A}\mbox{ (signed by \apri{A})}}
    \\\hline
    
    \send{A}{B}{m}
    & Message \msg{m} sent from \apri{A} to \apri{B}.
    \\\hline

    \func{\extxt{func}}{\avar{x},\avar{y}}
    & A function $\textit{\extxt{func}}$ with two arguments \avar{x} 
      and \avar{y} (\afname{Encrypt} and \afname{Decrypt} described
      below are examples of such a function).
    \\\hline

    \func{\extxt{func}}{\avar{x},\avar{y}}[\avar{z}]
    & We use an arrow {\produces} to illustrate what a function produces
      (in this case \avar{z}).  The following example shows that the function
      \afname{Encrypt} produces a ciphertext encrypted with the given shared
      key (see below for the description of other parts of the notation used
      in the example):
      \newline
      \example{\encrypt{A,B}{m}[*]}
    \\\hline

    \encrypted*{\raisebox{-2pt}{\akey{\square}}}{m}
    & In general, a subscripted structured value means an encrypted 
      value or message (a ciphertext), where the subscript
      \raisebox{0pt}{\akey{\square}} represents the encryption key
      (or the holder of the encryption key).  This is an example where
      the plain text \aval{m} is encrypted with the encryption key
      \akey{K}:
      \newline
      \example{\encrypted*{K}{m}}
    \\\hline
    
    \signed*{\raisebox{0pt}{\akey{\square}}}{m}
    & In general, a superscripted structured value means a signed
      value or message, where the superscript \raisebox{0pt}{\akey{\square}}
      represents the key used to sign (or the holder of the key used to sign).
      This is an example where the plain text \aval{m} is signed by
      principal~\apri{A}:
      \newline
      \example{\signed!{A}{m}}
    \\\hline
    
    % \encrypted*{K}{m}
    % & Plain text \aval{m} is encrypted with key \akey{K}.
    % \\\hline

    % \encrypted+{A}{m}
    % & Plain text \aval{m} is encrypted with public key \key+{A}.
    % \\\hline
    
    \encrypt{A,B}{m}
    & Encrypt plain text \aval{m} with shared key \key{A,B}:
      \newline
      \example{\encrypt{A,B}{m}[*]}
    \\\hline
    
    \decrypt{A,B}{\avar{c}}
    & Decrypt cipher text \avar{c} with shared key \key{A,B}, where
      $\avar{c}=\encrypted{A,B}{m}$:
      \newline
      \example{\decrypt{A,B}{\avar{c}}\leadsto
      \decrypt[big]{A,B}{\encrypted{A,B}{m}}[m]}
    \\\hline

    \encrypt+{A}{m}
    & Encrypt plain text \aval{m} with public key \key+{A}:
      \newline
      \example{\encrypt+{A}{m}[*]}
    \\\hline

    \decrypt-{A}{\avar{c}}
    & Decrypt cipher text \avar{c} with private key \key-{A}, where
      $\avar{c}=\encrypted+{A}{m}$:
      \newline
      \example{\decrypt-{A}{\avar{c}}\leadsto
      \decrypt-[big]{A}{\encrypted+{A}{m}}[m]}
    \\\hline

    \chash{m}
    & A cryptographic hash value of \aval{m}.
    \\\hline

    \chashf{m}
    & A cryptographic hash function producing the cryptographic hash
      value of \aval{m}:
      \newline
      \example{%
        \chashf{m}[*]}
    \\\hline

    \mac{A}{m}
    & The message authentication code of \aval{m} with key \key{A}.
    \\\hline

    \cmac{A}{m}
    & The cipher-based message authentication code of \aval{m} with key
      \key{A}.
    \\\hline

    \hmac{A}{m}
    & The HMAC message authentication code \cite{bellare1996a} of
      \aval{m} with key \key{A}.
    \\\hline

    \macf{A}{m}
    & The message authentication code function producing the message
      authentication code of \aval{m} with key \key{A}:
      \newline
      \example{\macf{A}{m}[*]}
    \\\hline

    \cmacf{A}{m}
    & The cipher-based message authentication code function producing the
      cipher-based message authentication code of \aval{m} with key \key{A}:
      \newline
      \example{%
        \cmacf{A}{m}[*]}
    \\\hline

    \hmacf{A}{m}
    & The HMAC message authentication code function producing the HMAC
      message authentication code of \aval{m} with key \key{A}:
      \newline
      \example{%
      \hmacf{A}{m}[*]\leadsto
      \chash[big]{\akey{\overline{K}_A}\axor\textit{opad}\aconcat
      \chash{\akey{\overline{K}_A}\axor\textit{ipad}\aconcat m}}\\
    \akey{\overline{K}_A} \ = \ \; \Biggr\{
    \raisebox{0pt}{%
    $\def\arraystretch{1}\begin{array}{ll@{}}
      \chash{\key{A}} & \textrm{if \key{A} is larger than  block size} \\
      \key{A} & \textrm{otherwise}
    \end{array}$}}\newline
    The two block-sized paddings, \aval{\textit{opad}} (outer padding) and
    \aval{\textit{ipad}} (inner padding), each consists of a repeating byte
    value (\aval{0\textrm{x}5\textrm{c}} and \aval{0\textrm{x}36},     
    respectively).
    \\\hline

    \sig!{A}{m}
    & Digital (cryptographic) signature of \aval{m} signed by \apri{A}.
    \\\hline

    \sig-{A}{m}
    & Digital (cryptographic) signature of \aval{m} signed with private key
      \key-{A}:
      \newline
      \example{\sig-{A}{m}\leadsto\encrypted-[big]{A}{\chash{m}}}
    \\\hline
    
    \sig!{A,B}{m}
    & Digital (cryptographic) signature of \aval{m} based on shared secret
      between \apri{A} and \apri{B}.
    \\\hline

    \sig{A,B}{m}
    & Digital (cryptographic) signature of \aval{m} signed with the shared 
      key \key{A,B} (a shared secret between \apri{A} and \apri{B}):
      \newline
      \example{\sig{A}{m}\leadsto\encrypted[big]{A,B}{\chash{m}}}
    \\\hline

    \sigf-{A}{m}
    & Function creating a digital (cryptographic) signature of \aval{m}
      with private key \key-{A}:
      \newline
      \example{\sigf-{A}{m}[*]}
    \\\hline

    \sigf!{A,B}{m}
    & Function creating a digital (cryptographic) signature of \aval{m}
      based on shared secret between \apri{A} and \apri{B}:
      \newline
      \example{\sigf!{A,B}{m}[*]}
    \\\hline

    \sigf{A,B}{m}
    & Function creating a digital (cryptographic) signature of \aval{m}
      with the shared key \key{A,B} (a shared secret between \apri{A}
      and \apri{B}):
      \newline
      \example{\sigf{A,B}{m}[*]}
    \\\hline

    \signed!{A}{m}
    & \aval{m} is signed by \apri{A} (\aval{m} signed is a combination
      of \aval{m} itself and a digital signature of \aval{m}, in this case
      a digital signature signed by \apri{A}):
      \newline
      \example{\signed!{A}{m}\leadsto\sval[big]{m,\sig!{A}{m}}}
    \\\hline

    \signed-{A}{m}
    & \aval{m} is signed with private key \key-{A} (\aval{m}
      signed is a combination of \aval{m} itself and a digital signature of
      \aval{m}, in this case a digital signature signed with \key-{A}
      implemented by encrypting the cryptographic hash value of \aval{m} with
      \key-{A}):
      \newline
      \example{\signed-{A}{m}\leadsto\sval[big]{m,\sig-{A}{m}}
      \leadsto\sval[Big]{m,\encrypted-[big]{A}{\chash{m}}}}
    \\\hline

    \signed!{A,B}{m}
    & \aval{m} is signed with shared secret of \apri{A} and \apri{B}\/
      (\aval{m} signed is a combination of \aval{m} itself and a digital
      signature of \aval{m}, in this case a digital signature signed with
      a shared secret of \apri{A} and \apri{B}):
      \newline
      \example{\signed!{A,B}{m}\leadsto\sval[big]{m,\sig!{A,B}{m}}}
    \\\hline

    \signed{A,B}{m}
    & \aval{m} is signed with a shared secret of \apri{A} and \apri{B};
      the shared key \key{A,B} (\aval{m} signed is a combination of
      \aval{m} itself and a digital signature of \aval{m}, in this case
      a digital signature signed with the shared key \key{A,B} implemented
      by encrypting the cryptographic hash value of \aval{m} with
      \key{A,B}):
      \newline
      \example{\signed{A,B}{m}\leadsto\sval[big]{m,\sig{A,B}{m}}
      \leadsto\sval[Big]{m,\encrypted[big]{A,B}{\chash{m}}}}
    \\\hline
    
    \sign!{A}{m}
    & \apri{A} signs \aval{m} (\aval{m} signed is a combination of
      \aval{m} itself and a digital signature of \aval{m}, in this
      case a digital signature signed by \apri{A} implemented by \aname{A}
      encrypting the cryptographic hash value of \aval{m}):
      \newline
      \example{\sign!{A}{m}[*]\leadsto
      \sval[big]{m,\sig!{A}{m}}}
    \\\hline
 
    \sign-{A}{m}
    & Sign \aval{m} with private key \key-{A} (\aval{m} signed is
      a combination of \aval{m} itself and a digital signature of
      \aval{m}, in this case a digital signature signed with \key-{A}
      implemented by encrypting the cryptographic hash value of \aval{m}
      with \key-{A}):
      \newline
      \example{\sign-{A}{m}[*]\leadsto
      \sval[big]{m,\sig-{A}{m}}\leadsto
      \sval[Big]{m,\encrypted-[big]{A}{\chash{m}}}}
    \\\hline
     
    \sign!{A,B}{m}
    & Sign \aval{m} with shared secret of \apri{A} and \apri{B}
      (\aval{m} signed is a combination of \aval{m} itself and a
      digital signature of \aval{m}, in this case a digital signature
      signed with a shared secret of \apri{A} and \apri{B} implemented by
      encrypting the cryptographic hash value of \aval{m}
      with a key based on a shared secret of \aname{A} and \aname{B}):
      \newline
      \example{\sign!{A,B}{m}[*]\leadsto
      \sval[big]{m,\sig!{A,B}{m}}}
    \\\hline
     
    \sign{A,B}{m}
    & Sign \aval{m} with a shared secret of \apri{A} and \apri{B}\/; 
      the shared key \key{A,B} (\aval{m} signed is a combination of
      \aval{m} itself and a digital signature of \aval{m}, in this
      case a digital signature signed with the shared key \key{A,B}
      implemented by encrypting the cryptographic hash value of \aval{m}
      with \key{A,B}):
      \newline
      \example{\sign{A,B}{m}[*]\leadsto
      \sval[big]{m,\sig{A,B}{m}}\leadsto
      \sval[Big]{m,\encrypted[big]{A,B}{\chash{m}}}}
    \\\hline
     
    \pwkeyf{P}(s)
    & Create a secret key from the password \aval{P} with the
      salt \aval{s}.  The salt is optional in the notation.
      \emph{PBKDF2} is an examples of a password-based key derivation
      function. The function creates a new secret key:\newline
      \example{%
        \pwkeyf{P_1}[*] \\
        \pwkeyf_{PBKDF2}{P_2}(s)[*]}
    \\\hline
    
    \dhpubkeyf{A}(p)
    & Make a public key \key+{A} (a key share) from the private key \key-{A}
      and the public parameters \aval{p}, typically used in a Diffie–Hellman
      key exchange protocol~\cite{diffie1976a} (a Diffie–Hellman key share).
      The public parameters argument is optional:\newline
      \example{%
        \dhpubkeyf{A}[A]\\
        \dhpubkeyf{B}(p)[B]}\newline
      In the original implementation of Diffie-Hellman (Finite Field
      Diffie–Hellman) the public parameters consists of a agreed upon
      prime and a primitive root. 
    \\\hline
    
    \dhkeyf{A}{B}(p)
    & Combine private key \key-{A} with public key \key+{B} and the
      public parameters \aval{p} (optional) to generate a new secret (shared) 
      key \key{A,B}, typically the result of a Diffie–Hellman key exchange
      protocol~\cite{diffie1976a}.  The public parameters argument
      is optional:\newline
      \example{%
        \dhkeyf{A}{B}[A,B]\\
        \dhkeyf{B}{A}(p)[A,B]}\newline
      These functions are one-way functions where the private keys
      \key-{A} and \key-{B} can not be calculated (in reasonable time)
      with only the knowledge of the public keys \key+{A} and \key+{B} 
      and the public parameters \aval{p}.  And as a consequence the 
      new shared secret key \key{A,B} is also difficult (impossible in
      practice) to calculate.
    \\\hline
    
    \verify+{A}{\avar{s}}
    & Verify that the signed structured value (message) \avar{s} is
      signed by the matching private key \key-{A} of public key \key+{A}
      and, as a consequence, verify that \avar{s} is signed by~\apri{A}:
      \newline
      \example{%
        \verify+{A}{\avar{s}}\leadsto \verify+[big]{A}{\signed!{x}{m}}
        \leadsto \verify+[Big]{A}{\sval[big]{m,\sig!{x}{m}}}\leadsto \\
        \verify+[Big]{A}{\sval[big]{m,\sig-{x}{m}}}\leadsto
        \verify+[bigg]{A}{\sval[Big]{m,\encrypted-[big]{x}{\chash{m}}}}:
        \\[1.5ex]\hline
        \begin{array}{@{}c}
          \decrypt+[big]{A}{\sig!{x}{m}}=\chash{m} \enspace \leadsto \\
          \decrypt+[big]{A}{\sig-{x}{m}}=\chash{m} \enspace \leadsto \\
          \decrypt+[Big]{A}{\encrypted-[big]{x}{\chash{m}}}=\chash{m}
        \end{array} \raisebox{-2pt}{$\Bigggggr\}$} \quad
        \raisebox{-2pt}{$\aiffthen$} \quad
        \raisebox{-2pt}{$\key-{A} = \key-{x}$}  \\[1.5ex]\hline
        \verify+{A}{\avar{s}}[\atrue] \quad \aiffthen
        \quad \key-{A} = \key-{x}}
    \\\hline

    \verify!{C}{\avar{s}}
    & Verify that the signed structured value (message) \avar{s} is
      signed by principal \apri{C}.
    \\\hline

    \certificate!{C}{\apri{A},\key+{A}}
    & A certificate where certificate authority \apri{C} binds identity
      \apri{A} to public key \key+{A} (in the example, \aval{\ldots}
      is other certificate related meta-data):
      \newline
      \example{%
        \certificate!{C}{\apri{A},\key+{A}}\leadsto
        \signed!{C}{\apri{A},\key+{A},\aval{\ldots}}}
    \\\hline

    \certificate-{C}{\apri{A},\key+{A}}
    & A certificate where a certificate authority with private key \key-{C}
      binds identity \apri{A} to public key \key+{A} (in the example,
      \aval{\ldots} is other certificate related meta-data):
      \newline
      \example{%
        \certificate-{C}{A,\key+{A}}\leadsto
        \signed-{C}{A,\key+{A},\aval{\dots}} \\\hline
        \verify+{C}{\certificate-{C}{A,\key+{A}}}\enspace\leadsto
        \enspace\verify+{C}{%
          \signed-{C}{A,\key+{A},\aval{\dots}}}[\atrue]}
    \\\Xhline{0.5pt}

  \end{xltabular}}

\subsection{BAN logic}
\label{sec:notation-ban}

The description below of the BAN logic notation is copied directly,
with some minor modifications, from the original paper presenting the
BAN logic, ``A Logic of Authentication''~\cite{burrows1989a}.

{\renewcommand{\arraystretch}{1.6}
  \begin{xltabular}{\textwidth}{lX}\Xhline{0.5pt}

    \textbf{Notation}
    & \textbf{Description}
    \\\Xhline{0.5pt}

    \apri{A}\believes\aval{X}
    & \apri{A} \emph{believes} \aval{X}, or \apri{A} would be entitled to
      believe \aval{X}. In particular the principal \apri{A} may act as though
      \aval{X} is true. This construct is central to the BAN logic. \\\hline

    \apri{A}\sees\aval{X}
    & \apri{A} \emph{sees} \aval{X}. Someone has sent a message containing
      \aval{X} to \apri{A}, who can read and repeat \aval{X} possibly after
      doing some decryption.
    \\\hline

    \apri{A}\oncesaid\aval{X}
    & \apri{A} \emph{once said} \aval{X}. The principal \apri{A} at some time
      sent a message including the statement \aval{X}. It is not known whether
      the message was sent long ago or during the current run of the
      protocol, but it is known that \apri{A} believed \aval{X} when \apri{A}
      sent the message.
    \\\hline

    \apri{A}\controls\aval{X}
    & \apri{A} has \emph{jurisdiction} over \aval{X} (\apri{A}
      \emph{controls} \aval{X}). The principal \apri{A} is an authority on
      \aval{X} and should be trusted on this matter. This construct is used
      when a principal has delegated authority over some statement. For
      example, encryption keys need to be generated with some care, and in
      some protocols certain servers are trusted to do this properly. This
      may be expressed by the assumption that the principals believe that
      the server has jurisdiction over statements about the quality of keys.
    \\\hline

    \fresh{X}
    & The formula \aval{X} is \emph{fresh}, that is, \aval{X} has not been
      sent in a message at any time before the current run of the protocol.
      This is usually true for nonces, that is expressions generated for
      the purpose of being fresh (nonce---number used once). Nonces
      commonly include a timestamp or a number that is used only once,
      such as a sequence number.
    \\\hline

    \apri{A}\asharedkey{K}\apri{B}
    & \apri{A} and \apri{B} may use the \emph{shared key} \akey{K} to
      communicate. The key \akey{K} is good, in that it will never be
      discovered by any principal except \apri{A} or \apri{B}, or a
      principal trusted by either \apri{A} or~\apri{B}. (In {\aspen}, a
      shared key \apri{A} and \apri{B} may use to communicate can be
      denoted~\key{A,B}.)
    \\\hline      

    \thepubkey{K}\apri{A}
    & \apri{A} has \akey{K} as a \emph{public key}. The matching secret
      key (the inverse of \akey{K}, denoted \akey{K^{-1}}) will never be
      discovered by any principal except \apri{A}, or a principal trusted
      by \apri{A}. (In {\aspen}, a public key of \apri{A} can be denoted
      \key+{A}, and the inverse of \key+{A}, the private key, is
      denoted~\key-{A}.)
    \\\hline   

    \apri{A}\asecret{X}\apri{B}
    & The formula \aval{X} is a \emph{secret} known only to \apri{A} and
      \apri{B}, and possibly to principals trusted by them.  Only \apri{A}
      and \apri{B} may use \aval{X} to prove their identities to one
      another. Often \aval{X} is fresh as well as secret.  An example of a
      shared secret is a password.
    \\\hline

    \encryptedwith{K}{X}
    & This represents the formula \aval{X} \emph{encrypted} under the key
      \akey{K}. Formally, \encryptedwith{K}{X} is an abbreviation for an
      expression of the form \encryptedwith{K}{X} \emph{from} \apri{A}.  We
      make the realistic assumption that each principal is able to recognize
      and ignore his own messages; the originator of each message is mentioned
      for this purpose. In the interests of brevity, we typically omit this
      in our examples.
    \\\hline

    \combine{\aval{X}}{\aval{Y}}
    & This represents \aval{X} \emph{combined} with the formula \aval{Y};
      it is intended that \aval{Y} be a secret, and that its presence prove
      the identity of whoever utters\combine{\aval{X}}{\aval{Y}}. In
      implementations, \aval{X} is simply concatenated with the password
      \aval{Y}; our notation highlights that \aval{Y} plays a special
      r{\^o}le, as proof of origin for \aval{X}. The notation is intentionally
      reminiscent of that for encryption, which also guarantees the
      identity of the source of a message through knowledge of a certain kind
      of secret.
    \\\Xhline{0.5pt}
                                                                            
  \end{xltabular}}

In the {\aspen} notation, when we write \key{A,B}, it is implicit that
\apri{A} and \apri{B} may use \key{A,B} to communicate. We can use the
BAN logic notation to make it explicit:

\[
  \apri{A}\asharedkey{\key{A,B}}\apri{B}
\]

In a similar manner, \key+{A} is in the {\aspen} notation implicit a
\emph{public key} of \apri{A}.  We can use the BAN logic notation to
make it explicit:

\[
  \thepubkey{\key+{A}}\apri{A}
\]

Both the BAN logic notation and {\aspen} use the notation
\encrypted*{K}{m} for the formula \aval{m} \emph{encrypted} under the
key \key*{K} (\aval{m} encrypted with the key \key*{K}).  In this
case, {\aspen} has adopted the notation used in BAN logic and in a lot
of other related publications and text books.


\clearpage
\section{Use the notation in text}
\label{sec:write-notation-latex}

This section explains how to use {\aspen} in {\latex} documents.
The new {\latex} commands and environments used are defined in the
{\latex} package \acmd{aspen}.

We will in the text include notation examples that might not make
sense in a security protocol perspective. However, they are included
for completeness. We will in the documentation try to include a wide
range of possibilities available from the {\latex} package
\acmd{aspen}.

For commands with arguments, the argument types are given using a
notation inspired by the \acmd{xparse} argument specification:

{\renewcommand{\arraystretch}{1.3}%
  \begin{xltabular}{\textwidth}{%
    @{\hskip 1em\relax}lX@{\hskip -1.2em\relax}|@{\hskip 1.2em\relax}lX}
    \acmd{\Verb|m|} & Mandatory arguments\newline
                    \emph{Examples:} \Verb|\cmd{arg}|
    &  \acmd{\Verb|B|} & Optional bracket sizes (\acmd{big}, \acmd{Big},
                         \ldots)\newline
                         \emph{Examples:} \Verb|\cmd|, \Verb|\cmd[Big]| \\
    \acmd{\Verb|o|} & Optional arguments\newline
                      \emph{Examples:} \Verb|\cmd|, \Verb|\cmd[arg]|
    & \acmd{\Verb|s|} & Optional stars (alternative versions)\newline
                      \emph{Examples:} \Verb|\cmd|, \Verb|\cmd*| \\
    \acmd{\Verb|O{default}|} & Optionals with default value \newline
                               \emph{Examples:} \Verb|\cmd|, \Verb|\cmd[arg]|
    & \acmd{\Verb|T|} & Optional key types: \Verb|*|, \Verb|-|, \Verb|+|,
                        \Verb|!|, \Verb|'|, or \Verb|"|\newline
                        \emph{Examples:} \Verb|\cmd|,
                        \Verb|\cmd-|, \Verb|\cmd!| \\
     \acmd{\Verb|p|} & Optionals in parenthesis \newline
                          \emph{Examples:} \Verb|\cmd|, \Verb|\cmd(arg)|
    & \acmd{\Verb|x|} & Optionals with magic return \newline
                   \emph{Examples:} \Verb|\cmd|, \Verb|\cmd[*]|,
                   \Verb|\cmd[arg]| \\
    \acmd{\Verb|P{default}|} & Parenthesis optionals with default\newline
                          \emph{Examples:} \Verb|\cmd|, \Verb|\cmd(arg)|
    & \acmd{\Verb|i|} & Optional markers (more details)\newline
                      \emph{Examples:} \Verb|\cmd|, \Verb|\cmd_{arg}|
    %& {\produces} & Makes a command (with arguments)\newline
    %                \emph{Examples}: \cmdargs{mktval}{om}[sBim]
  \end{xltabular}}

We can use this notation to specify the type of the arguments to a
command.  For example, \acmd{\Verb|om|} says that the command takes
two arguments where the first one is optional (in square brackets).
We use the symbol {\produces} to specify the arguments of a command
created by another command.  For example, \acmd{\Verb|\mktval|} has
one optional argument (\acmd{\Verb|o|}) and one mandatory argument
(\acmd{\Verb|m|})and returns a new command that has one optional star
argument (\acmd{\Verb|*|}), one optional bracket size argument
(\acmd{\Verb|B|}), one optional marker (\acmd{\Verb|i|}), and one
mandatory argument (\acmd{\Verb|m|}):
\begin{quote}
  \cmdargs{mktval}{om}[sBim]
\end{quote}

The optional magic return type \acmd{\Verb|x|} is available for some
predefined functions and can be be made available for functions
created with the commands \acmd{\Verb|\mkfunc|} and
\acmd{\Verb|\mkkfunc|}.  The magic return value \acmd{\Verb|*|} will
create the return value based on what the function does.  For example,
if magic return is used with the encrypt function, the return value
created will be the encrypted value:
\begin{quote}
  \cmdargs{encrypt}{TBimmx} \newline
  \acmd{\Verb|\encrypt+{A}{m}[*]|}\gives\encrypt+{A}{m}[*]
\end{quote}

% A few commands provided creates new {\latex} commands (these commands
% typically starts with \acmd{\Verb|\mk|}.  In these cases, we can then
% specify the arguments both for the \acmd{\Verb|\mk|} command and for
% command created: \acmd{\Verb|om|}~{\produces}~\acmd{\Verb|sBim|}.

%\clearpage
\subsection{{\aspen}}
\label{sec:latex-aspen}

The table below lists the {\aspen} notation with the matching {\latex}
commands. More examples of the usage of the notation are found in
Section \ref{sec:ex-notation-usage}.

{\renewcommand{\arraystretch}{1.6}%
  \begin{xltabular}{\textwidth}{l@{\hspace{.8em}}X}\Xhline{0.5pt}

    \textbf{Notation}
    & \textbf{{\latex} code and description}
    \\\Xhline{0.5pt}

    $=,<,\leq,>,\geq$
    & \acmd{=},\acmd{<},\acmd{\Verb|\leq|},\acmd{>},\acmd{\Verb|\geq|},
      used to compare values.
    \\\hline

   $\!\axor\!,\aconcat$
    & \acmd{\Verb|\axor|}, \acmd{\Verb|\aconcat|}, used as binary operators
      for \emph{exclusive or} and \emph{concatenation} (used to concatenate
      two values or strings), respectively.
    \\\hline
    
    $\aifthen,\aiffthen$
    & \acmd{\Verb|\aifthen|},\acmd{\Verb|\aiffthen|}, used to reason about
      protocols and protocol steps (meaning, \emph{``if, then''} and
      \emph{``if, and only if, then''}, respectively).
    \\\hline

    $\extxt{x}\leadsto\extxt{y}$
    & \acmd{\Verb|x \leadsto y|}, used to unpack more details.
    \\\hline
                  
    $\aval{1},\aval{2}$
    & \acmd{\Verb|\aval{1}|},\acmd{\Verb|\aval{2}|}, used for
      values.\\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{aval}{m}\newline
                        \cmdargex{aval}{\cmdmarg{value}}
    \\\hline

    $\atrue,\afalse$
    & \acmd{\Verb|\atrue|},\acmd{\Verb|\afalse|}, used for the boolean values.
    \\\hline

    $\apri{A},\apri{B},\apri{S}$
    & \acmd{\Verb|\apri{A}|},\acmd{\Verb|\apri{B}|},\acmd{\Verb|\apri{S}|},
      used for principals.\\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{apri}{m}\newline
                        \cmdargex{apri}{\cmdmarg{principal}}
    \\\hline

    $\anonce{N_A},\nonce{S}$
    & \acmd{\Verb|\anonce{N_A}|},\acmd{\Verb|\nonce{S}|},
      used for nonces. The \acmd{\Verb|\nonce|}
      command has an optional first argument to change the symbol
      (the letter): \acmd{\Verb|\nonce[n]{0}|}\;\givesarrow\;\nonce[n]{0}
    \\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{anonce}{m}, \cmdargs{nonce}{O{N}m}\newline
                        \cmdargex{anonce}{\cmdmarg{name}},
                        \cmdargex{nonce}{\cmdoarg{symbol}\cmdmarg{id}}
    \\\hline

    $\acounter{C_A},\counter{B}$
    & \acmd{\Verb|\acounter{C_A}|},\acmd{\Verb|\counter{B}|},
      used for indexes or counters. The \acmd{\Verb|\counter|}
      command has an optional first argument to change the symbol
      (the letter): \acmd{\Verb|\counter[i]{0}|}\;\givesarrow\;\counter[i]{0}
    \\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{acounter}{m}, \cmdargs{counter}{O{I}m}\newline
                        \cmdargex{acounter}{\cmdmarg{name}},
                        \cmdargex{counter}{\cmdoarg{symbol}\cmdmarg{id}}
    \\\hline

    $\arandom{R_x},\random{y},\random'{1}$
    & \acmd{\Verb|\arandom{R_x}|},\acmd{\Verb|\random{y}|},%
      \acmd{\Verb|\random'{1}|},
      used for random values (the $\smark$
      hints about limited useful lifetime). The \acmd{\Verb|\random|}
      command has an optional first argument to change the symbol
      (the letter): \acmd{\Verb|\random[r]{z}|}\;\givesarrow\;\random[r]{z}
    \\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{arandom}{m}, \cmdargs{random}{O{R}m}\newline
                        \cmdargex{arandom}{\cmdmarg{name}},
                        \cmdargex{random}{\cmdoarg{symbol}\cmdmarg{id}}
    \\\hline

    $\ats{T_A},\ts{S},\attl{L},\ttl{1}$ 
    & \acmd{\Verb|\ats{T_A}|},\acmd{\Verb|\ts{S}|},\acmd{\Verb|\attl{L}|},%
      \acmd{\Verb|\ttl{1}|}, used for time related values, like time stamps
      and lifetime (time to live). Both the \acmd{\Verb|\ts|} and
      \acmd{\Verb|\ttl|} command have an optional first argument to change
      the symbol (the letter): \acmd{\Verb|\ts[t]{0}|}\;\givesarrow\;\ts[t]{0},
      \acmd{\Verb|\ttl[l]{1}|}\;\givesarrow\;\ttl[l]{1}\\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{ats}{m}, \cmdargs{ts}{O{T}m},
                        \cmdargs{attl}{m}, \cmdargs{ttl}{O{L}m}\newline
                        \cmdargex{ats}{\cmdmarg{name}},
                        \cmdargex{ts}{\cmdoarg{symbol}\cmdmarg{id}},\newline
                        \cmdargex{attl}{\cmdmarg{name}},
                        \cmdargex{ttl}{\cmdoarg{symbol}\cmdmarg{id}}
    \\\hline

    $\astr{Hello}$
    & \acmd{\Verb|\astr{Hello}|}, used for text strings.\\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{astr}{m}\newline
                        \cmdargex{astr}{\cmdmarg{str}}
    \\\hline

    $\avar{x},\avar{y}$
    & \acmd{\Verb|\avar{x}|},\acmd{\Verb|\avar{y}|}, used for variables.
    \\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{avar}{m}\newline
                        \cmdargex{avar}{\cmdmarg{variable}}
    \\\hline

    $\privkey[]{},\pubkey[]{},\sessionkey[]{},\;\ldots$
    & Some command markers (key type markers) are used throughout the {\aspen}
      {\latex} package to specify the key type involved:
      \newline
      {\renewcommand{\arraystretch}{1}\begin{tabular}{c@{\::\:~}l}
        \acmd{*}
        & Means no specific variant (argument is the key, not the label):
          \acmd{\Verb|\key*{K}|} \\
        \acmd{-}
        & Mark that it is a private key (from a public-private key pair):
          \acmd{\Verb|\key-{A}|} \\
        \acmd{+}
        & Mark that it is a public key (from a public-private key pair):
          \acmd{\Verb|\key+{A}|} \\
        \acmd{!}
        & Mark by principal instead of key (the key of):
          \acmd{\Verb|\key!{A}|} \\
        \acmd{'}
        & Mark that it is temporary (session key or limited lifetime):
          \acmd{\Verb|\key'{A}|} \\
        \acmd{"}
        & Mark that it is a key generated from the password:
          \acmd{\Verb|\key"{P}|} \\
      \end{tabular}}\newline
    \example{\begin{tabular}{lcl}
      \acmd{\Verb|\key*{K}|} & \givesarrow & $\key*{K}$ \\
      \acmd{\Verb|\encrypted"{P}{\key-{B}}|} & \givesarrow 
      &  $\encrypted"{P}{\key-{B}}$ \\
      \acmd{\Verb|\sig-{A}{m}|} & \givesarrow & $\sig-{A}{m}$ \\
      \acmd{\Verb|\encrypt+{B}{m}|} & \givesarrow & $\encrypt+{B}{m}$ \\
      \acmd{\Verb|\signed!{S}{m}|} & \givesarrow & $\signed!{S}{m}$ \\
      \acmd{\Verb|\decrypt'{A,B}{c}|} & \givesarrow & $\decrypt'{A,B}{c}$
    \end{tabular}}\vspace*{-2.0ex}
    \\ \nopagebreak
    \emph{Arguments:} & \acmd{\Verb|T|} (the symbol used for these 
                        optional markers in argument specifications)
    \\\hline      

    $\akey{K}$
    & \acmd{\Verb|\akey{K}|}, used for (non-specific) encryption keys.
      If you mark the \acmd{\Verb|key|} command with a \acmd{*}, the
      produced output is the same: \acmd{\Verb|\key*{K}|}\gives\key*{K}
    \\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{akey}{m}, \cmdargs{key}{Tm}\newline
                        \cmdargex{akey}{\cmdmarg{key}},
                        \cmdargex{key}{{\cmdkarg}\cmdmarg{key}}
    \\\hline

    $\key{A},\sharedkey{A,B}$
    & \acmd{\Verb|\key{A}|},\acmd{\Verb|\sharedkey{A,B}|}, used for shared
      (secret/symmetric) keys (provided by two different {\latex} commands,
      where the first is a more compact version; use whatever you prefer).
      The \acmd{\Verb|\sharedkey|} command has an optional first argument
      to change the symbol (the letter):
      \acmd{\Verb|\sharedkey[k]{B}|}\;\givesarrow\;\sharedkey[k]{B}
    \\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{key}{Tm}, \cmdargs{sharedkey}{O{K}m}\newline
                        \cmdargex{key}{\cmdmarg{id}},
                        \cmdargex{sharedkey}{\cmdoarg{symbol}\cmdmarg{id}}
    \\\hline
    
    $\key'{C,S},\sessionkey{A,B,S}$
    & \acmd{\Verb|\key'{C,S}|},\acmd{\Verb|\sessionkey{A,B,S}|}, used for
      session keys (provided by two different {\latex} commands, where the
      first is a more compact version; use whatever you prefer).
      The \acmd{\Verb|\sessionkey|} command has an optional first argument
      to change the symbol (the letter):
      \acmd{\Verb|\sessionkey[k]{A,B}|}\;\givesarrow\;\sessionkey[k]{A,B}%
    \\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{key}{Tm}, \cmdargs{sessionkey}{O{K}m}\newline
                        \cmdargex{key}{'\cmdmarg{id}},
                        \cmdargex{sessionkey}{\cmdoarg{symbol}\cmdmarg{id}}
    \\\hline
    
    $\key+{A},\pubkey{B}$
    & \acmd{\Verb|\key+{A}|},\acmd{\Verb|\pubkey{B}|}, used for public keys
      (provided by two different {\latex} commands, where the first is a
      more compact version; use whatever you prefer).
      The \acmd{\Verb|\pubkey|} command has an optional first argument
      to change the symbol (the letter):
      \acmd{\Verb|\pubkey[k]{S}|}\;\givesarrow\;\pubkey[k]{S}
    \\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{key}{Tm}, \cmdargs{pubkey}{O{K}m}\newline
                        \cmdargex{key}{+\cmdmarg{id}},
                        \cmdargex{pubkey}{\cmdoarg{symbol}\cmdmarg{id}}
    \\\hline
    
    $\key-{A},\privkey{B}$
    & \acmd{\Verb|\key-{A}|},\acmd{\Verb|\privkey{B}|}, used for private keys
      (provided by two different {\latex} commands, where the first is a
      more compact version; use whatever you prefer).
      The \acmd{\Verb|\privkey|} command has an optional first argument
      to change the symbol (the letter):
      \acmd{\Verb|\privkey[k]{A}|}\;\givesarrow\;\privkey[k]{A}
    \\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{key}{Tm}, \cmdargs{privkey}{O{K}m}\newline
                        \cmdargex{key}{-\cmdmarg{id}},
                        \cmdargex{privkey}{\cmdoarg{symbol}\cmdmarg{id}}
    \\\hline

    $\key"{P_1},\pwkey{P_2}$
    & \acmd{\Verb|\key"{P_1}|},\acmd{\Verb|\pwkey{P_2}|}, used for keys
      generated from a password (provided by two different {\latex} commands,
      where the first is a more compact version; use whatever you prefer).
      The \acmd{\Verb|\pwkey|} command has an optional first argument
      to change the symbol (the letter):
      \acmd{\Verb|\pwkey[k]{P}|}\;\givesarrow\;\pwkey[k]{P}
    \\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{key}{Tm}, \cmdargs{pubkey}{O{K}m}\newline
                        \cmdargex{key}{"\cmdmarg{password}},
                        \cmdargex{pwkey}{\cmdoarg{symbol}\cmdmarg{password}}
    \\\hline

    % $\key!{A},\akey{\aname{B}}$
    % & \acmd{\Verb|\key!{A}|},\acmd{\Verb|\akey{\aname{B}}|}, used for
    %   unspecific keys of a principal (or a group of principals), typically 
    %   in the context of \emph{``encrypted by''}, or \emph{``signed by''}.
    %   (two different {\latex} commands, where the first is a more compact
    %   version).
    % \\\hline

    $\aname{A}$
    & \acmd{\Verb|\aname{A}|}, typically used to indicate who
      signed (or encrypted) a message, but no specific key is given, 
      known or relevant. If you mark a key with a \acmd{!},
      the produced output is the same: \acmd{\Verb|\key!{A}|}\gives\key!{A}
    \\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{aname}{m}, \cmdargs{key}{Tm}\newline
                        \cmdargex{aname}{\cmdmarg{id}},
                        \cmdargex{key}{!\cmdmarg{id}}
    \\\hline

    $\agroup{M}$
    & \acmd{\Verb|\agroup{M}|}, specifies a group and is typically used
      as a label for a shared key shared within a group with $n$ members:
      \newline
      \example{%
      \mbox{\acmd{\Verb|\key{\agroup{M}}|}}\gives\key{\agroup{M}}}%
      \vspace*{-2.2ex}\\
    %$\agroup[0][s]{M}$
    & \acmd{\Verb|\agroup[0][s]{M}|}, used when th group member indexes are
      non-standard:
      \newline
      \example{%
      \mbox{\acmd{\Verb|\key{\agroup[0][s]{M}}|}}\gives
      \key{\agroup[0][s]{M}}}\vspace*{-2.2ex}\\
    & \acmd{\Verb|\agroup*{M}|}, typically used in a text when referring 
      to a group (with $n$ members):
      \newline
      \example{%
      \mbox{\acmd{\Verb|\key{\agroup*{M}}|}}\gives
      \key{\agroup*{M}}}\vspace*{-2.2ex}\\
    %$\agroup*[0][s]{M}$
    & \acmd{\Verb|\agroup*[0][s]{M}|}, used when group member indexes are
      non-standard:\newline
      \example{%
      \mbox{\acmd{\Verb|\key{\agroup*[0][s]{M}}|}}\gives
      \key{\agroup*[0][s]{M}}}\vspace*{-2.0ex}\\ \nopagebreak
    \emph{Arguments:} & \cmdargs{agroup}{sO{1}O{n}m}\newline
                        \cmdargex{agroup}{%
                        {\cmdsarg}\cmdoarg{first}\cmdoarg{last}\cmdmarg{id}}
    \\\hline
    
    $\sval{m},\msg{\apri{A},\apri{B}}$
    & \acmd{\Verb|\sval{m}|},\acmd{\Verb|\msg{\apri{A},\apri{B}}|},
      used for a structured value or message (a message can be seen
      as structured value).\\[-1ex] \nopagebreak
    \emph{Arguments:} & \cmdargs{sval}{Bm}, \cmdargs{msg}{Bm}\newline
                        \cmdargex{sval}{\cmdoarg{size}\cmdmarg{value}},
                        \cmdargex{msg}{\cmdoarg{size}\cmdmarg{message}}
    \\\hline
    
    $\sval[big]{m}$
    & \acmd{\Verb|\sval[big]{m}|}, or \acmd{\Verb|\msg[big]{m}|},
      where first optional size argument can be
      \acmd{big}, \acmd{Big}, \acmd{bigg}, or \acmd{Bigg} for
      increased size of parenthesis (typically used with nested
      structured values and/or functions):
      \newline
      \example{%
        \mbox{\acmd{\Verb|\sval{x}|}}\gives\sval{x} \\
        \mbox{\acmd{\Verb|\sval[big]{\sval{x}}|}}\gives
        \sval[big]{\sval{x}} \\
        \mbox{\acmd{\Verb|\sval[Big]{\sval[big]{\sval{x}}}|}}\gives
        \sval[Big]{\sval[big]{\sval{x}}} \\
        \mbox{\acmd{\Verb|\sval[bigg]{\sval[Big]{\sval[big]{\sval{x}}}}|}}%
        \gives\sval[bigg]{\sval[Big]{\sval[big]{\sval{x}}}}%
      }\vspace*{-2.2ex}
    \\ &
      We can even use more size specifiers: \acmd{big}, \acmd{Big},
      \acmd{bigg}, \acmd{Bigg}, \acmd{biggg}, \acmd{Biggg},
      \acmd{bigggg}, \acmd{Bigggg}, \acmd{biggggg}, and 
      \acmd{Biggggg}:
      \newline
      \example{%
        \sval[Biggggg]{\sval[biggggg]{\sval[Bigggg]{\sval[bigggg]{%
          \sval[Biggg]{\sval[biggg]{\sval[Bigg]{\sval[bigg]{\sval[Big]{%
         \sval[big]{\sval{x}}}}}}}}}}}}\vspace*{-2.2ex}
      \\ &
      The optional size argument applies for all {\aspen} {\latex} commands
      that produces a pair of parenthesis, both ordinary parenthesis and
      curly brackets. A few examples (see below for more details on
      these commands):\newline
      \example{\begin{tabular}{@{}lcl@{}}%
        \mbox{\acmd{\Verb|\tval[big]{Type}{m}|}}
        & \givesarrow & \tval[big]{Type}{m} \\
        \mbox{\acmd{\Verb|\send[big]{A}{B}{m}|}}
        & \givesarrow & \send[big]{A}{B}{m} \\
        \mbox{\acmd{\Verb|\func[big]{Func}{x,y}|}}
        & \givesarrow & \func[big]{Func}{x,y} \\
        \mbox{\acmd{\Verb|\encrypted[big]{A,B}{m}|}}
        & \givesarrow & \encrypted[big]{A,B}{m}
      \end{tabular}}\vspace*{-2.0ex}\\ \nopagebreak
    \emph{Arguments:} & \cmdargs{sval}{Bm}, \cmdargs{msg}{Bm}\newline
                        \cmdargex{sval}{\cmdoarg{size}\cmdmarg{value}},
                        \cmdargex{msg}{\cmdoarg{size}\cmdmarg{message}}
    \\\hline
    
    ${}_{\aval{\ldots}}$
    & \acmd{\Verb|_{…}|},
      where the marker is used to provide more details about a structured
      value or a function. A few examples where the markers are
      \aval{\textit{MD5}}, \aval{\textit{RSA}}, \aval{\textit{AES}},
      \aval{\textit{DSA}}, and \aval{\textit{SHA-2}}:\newline
      \example{\begin{tabular}{lcl}
      \mbox{\acmd{\Verb|\chash_{MD5}{m}|}} & \givesarrow & $\chash_{MD5}{m}$ \\
      \mbox{\acmd{\Verb|\encrypt+_{RSA}{B}{m}|}} & \givesarrow
      & $\encrypt+_{RSA}{B}{m}$ \\
      \mbox{\acmd{\Verb|\decrypt'_{AES}{A,B}{c}|}} & \givesarrow
      & $\decrypt'_{AES}{A,B}{c}$ \\
      \mbox{\acmd{\Verb|\sig-_{DSA}{S}{m}|}} & \givesarrow
      & $\sig-_{DSA}{S}{m}$ \\
      \mbox{\acmd{\Verb|\hmac_{SHA-2}{A}{m}|}} & \givesarrow
      & $\hmac_{SHA-2}{A}{m}$
      \end{tabular}}\vspace*{-2.0ex}
    \\ \nopagebreak
    \emph{Arguments:} & \acmd{\Verb|i|} (the symbol used for such 
                        optional embellishment in argument specifications)
    \\\hline

    $\tval{Type}{m}$
    & \acmd{\Verb|\tval{Type}{m}|}, used for a typed structured value
      where the first argument is the type.
    % \\\hline    
    % $\tval*{Type}{\sval{m}}$
    % &
      The \acmd{\Verb|\tval*|} variant is used for a typed structured
      value where the first argument is the type, but the value
      is not wrapped with curly brackets.  This is typically used when
      the value is already wrapped as a structured value (e.g., encrypted
      or signed data). This is an example with a Kerberos Authenticator
      as a typed structured value:\newline
      \example{\begin{tabular}{@{}c@{}}%
      \mbox{\acmd{%
      \Verb|\tval*{KA}{\encrypted{S,C}{\apri{C},\textit{Addr}_C,\ts{t}}}|}} \\
        \givesarrow\quad
        \tval*{KA}{\encrypted{S,C}{\apri{C},\textit{Addr}_C,\ts{t}}}
               \end{tabular}}
      \vspace*{-2.2ex}\\ &
      The marker (\Verb|_{RSA}| in the example below) can be used to give more
      details about the typed structured value:\newline
      \example{\begin{tabular}{@{}c@{}}%
      \mbox{\acmd{%
      \Verb|\tval*{KA}_{RSA}{\encrypted{S,C}{\apri{C},\textit{Addr}_C,\ts{t}}}|%
      }}\\
      \givesarrow\quad
      \tval*{KA}_{RSA}{\encrypted{S,C}{\apri{C},\textit{Addr}_C,\ts{t}}}
      \end{tabular}}
      \vspace*{-2.0ex}\\ \nopagebreak
      \emph{Arguments:} & \cmdargs{tval}{sBmim}\newline
                          \cmdargex{tval}{{\cmdsarg}\cmdoarg{size}%
                          \cmdmarg{type}{\cmdearg}\cmdmarg{value}}
    \\\hline
    
    % \tval[big]{Type}{m}
    % & \acmd{\Verb|\tval[big]{Type}{m}|},
    %   where the optional argument of \acmd{\Verb|\tval|} can be
    %   \acmd{big}, \acmd{Big}, \acmd{bigg}, or \acmd{Bigg} for
    %   increased size of parenthesis (see examples with structured
    %   values above).
    % \\\hline
    
    $\send{A}{B}{m}$
    & \acmd{\Verb|\send{A}{B}{m}|}, used to specify that a message \sval{m}
      is sent from \apri{A} to \apri{B}.
    % \\\hline
    % \send[big]{A}{B}{m}
    % & \acmd{\Verb|\send[big]{A}{B}{m}|}, where the optional
    %   argument of \acmd{\Verb|\send|} can be
    %   \acmd{big}, \acmd{Big}, \acmd{bigg}, or \acmd{Bigg} for increased
    %   size of parenthesis (see examples with structured values above).
    % \\\hline
    % \send*{A}{B}{\avar{\extxt{x}}}
    % &
      The \acmd{\Verb|\send*|} variant is used to specify that
      the message is not wrapped as a structured value or message.
      This is typically used when what-is-sent is already wrapped as a
      structured value (e.g.,~encrypted or signed data):
      \newline
      \example{%
        \mbox{\acmd{\Verb|\send*{A}{B}{\encrypted+{B}{m}}|}}\gives
          \send*{A}{B}{\encrypted+{B}{m}}\\
        \mbox{\acmd{\Verb|\send*{A}{B}{\encrypted+[big]{B}{\chash{m}}}|}}%
          \gives\send*{A}{B}{\encrypted+[big]{B}{\chash{m}}}}
      \vspace*{-2.0ex}\\ \nopagebreak
      \emph{Arguments:} & \cmdargs{send}{sBmmm}\newline
                          \cmdargex{send}{{\cmdsarg}\cmdoarg{size}%
                          \cmdmarg{sender}\cmdmarg{receiver}\cmdmarg{message}}
    \\\hline

    $\func{Func}{x,y}$
    & \acmd{\Verb|\func{Func}{x,y}|}, used for any functions.
    %\\\hline
    % \func[big]{Func}{x,y}
    % & \acmd{\Verb|\func[big]{Func}{x,y}|}, where first optional argument
    %   can be \acmd{big}, \acmd{Big}, \acmd{bigg}, or \acmd{Bigg} 
    %   for increased size of parenthesis (see examples with structured
    %   values above).
    % \\\hline
    %$\func{Func}{x,y}[z]$
    % &
      An optional last argument is used if a return value of
      the function is given:\newline
      \example{%
        \mbox{\acmd{\Verb|\func{Func}{x,y}[z]|}}\gives
        \func{Func}{x,y}[z]}
        \vspace*{-2.0ex}\\ \nopagebreak
      \emph{Arguments:} & \cmdargs{func}{Bmimo}\newline
                          \cmdargex{func}{\cmdoarg{size}\cmdmarg{name}%
                          {\cmdearg}\cmdmarg{arguments}\cmdoarg{returns}}
    \\\hline

    % \func[big]{Func}{x,y}[z]
    % & \acmd{\Verb|\func[big]{Func}{x,y}[z]|}, used when the 
    %   return value of the function is given, and the first optional
    %   argument is \acmd{big}, \acmd{Big}, \acmd{bigg}, or
    %   \acmd{Bigg} for increased size of parenthesis (see examples with
    %   structured values above).
    % \\\hline

    $\encrypted{A,B}{m}$
    & \acmd{\Verb|\encrypted{A,B}{m}|}, where the message is encrypted
      with an shared secret
      encryption key (in this case, the shared key \key{A,B} of \apri{A}
      and \apri{B}). The other options (with markers) are:
      % \acmd{*}~indicates that the message is encrypted with given key
      % (the first non-optional argument is the key, and not the label of the
      % key).
      % \acmd{+}~indicates that the message is encrypted with a public
      % key. \acmd{-}~indicates that the message is
      % encrypted with a private key (sometimes used in digital
      % signatures). \acmd{!}~indicates that the message is encrypted
      % by a principal (not specifying the specific encryption key). All the
      % different options of \acmd{\Verb|\encrypted|} demonstrated:
      \newline
      \example{%
        \begin{tabular}{lcl}
          \mbox{\acmd{\Verb|\encrypted*{K}{m}|}} & \givesarrow
          & \encrypted*{K}{m} \\
          %\mbox{\acmd{\Verb|\encrypted{A,B}{m}|}} & \givesarrow
          %& \encrypted{A,B}{m} \\
          \mbox{\acmd{\Verb|\encrypted+{A}{m}|}} & \givesarrow
          & \encrypted+{A}{m} \\
          \mbox{\acmd{\Verb|\encrypted-{A}{m}|}} & \givesarrow
          & \encrypted-{A}{m} \\
          \mbox{\acmd{\Verb|\encrypted!{A}{m}|}} & \givesarrow
          & \encrypted!{A}{m} \\
          \mbox{\acmd{\Verb|\encrypted'{A,B}{m}|}} & \givesarrow
          & \encrypted'{A,B}{m} \\
          \mbox{\acmd{\Verb|\encrypted"{P}{m}|}} & \givesarrow
          & \encrypted"{P}{m} 
        \end{tabular}}\vspace*{-2.0ex}\\ \nopagebreak
      \emph{Arguments:} & \cmdargs{encrypted}{TBimm}\newline
                          \cmdargex{encrypted}{{\cmdkarg}\cmdoarg{size}%
                          {\cmdearg}\cmdmarg{key}\cmdmarg{plain}}
    \\\hline

    % \encrypted[big]{A,B}{m}
    % & \acmd{\Verb|\encrypted[big]{A,B}{m}|}, where the optional
    %   argument can be \acmd{big}, \acmd{Big}, \acmd{bigg}, or
    %   \acmd{Bigg} for increased size of parenthesis (see examples with
    %   structured values above). The optional size argument can be used for all
    %   different options of \acmd{\encrypted} (see previous).
    %   Typically used with structured values:
    %   \newline
    %   \example{%
    %     \mbox{\acmd{\Verb|\encrypted+[big]{B}{\signed-{A}{m}}|}}\gives
    %     \encrypted+[big]{B}{\signed-{A}{m}}}
    % \\\hline

    $\encrypt{A,B}{m}$
    & \acmd{\Verb|\encrypt{A,B}{m}|}, where the value
      \aval{m} is encrypted with a secret shared encryption key (in 
      this case, a shared key of \apri{A} and \apri{B}). Other options
      are \acmd{*}, \acmd{+}, \acmd{-}, \acmd{!}, \acmd{'}
      and \acmd{"} (see above for explanation). Since \acmd{\Verb|\encrypt|}
      is a function, we can include a return value as an optional last
      argument (and it supports magic return making straightforward to
      include the return value):
      \newline
      \example{%
        \mbox{\acmd{\Verb|\encrypt+{B}{m}[\encrypted+{B}{m}]|}}\gives
        \encrypt+{B}{m}[\encrypted+{B}{m}] \\
        \mbox{\acmd{\Verb|\encrypt+{B}{m}[*]|}}\gives
        \encrypt+{B}{m}[*]}\vspace*{-2.0ex}\\ \nopagebreak
      \emph{Arguments:} & \cmdargs{encrypt}{TBimmx}\newline
                          \cmdargex{encrypt}{{\cmdkarg}\cmdoarg{size}%
                          {\cmdearg}\cmdmarg{key}\cmdmarg{plain}%
                          \cmdoarg{returns}}
    \\\hline
    
    % \encrypt[big]{A,B}{m}
    % & \acmd{\Verb|\encrypt[big]{A,B}{m}|}, where the first optional argument
    %   can be \acmd{big}, \acmd{Big}, \acmd{bigg}, or \acmd{Bigg}
    %   for increased size of parenthesis (see examples with structured values
    %   above). Typically used with nested structured values:
    %   \newline
    %   \example{%
    %     \mbox{\acmd{\Verb|\encrypt+[big]{B}{\signed-{A}{m}}|}}\gives
    %     \encrypt+[big]{B}{\signed-{A}{m}}}
    % \\\hline
    
    $\decrypt{A,B}{\avar{c}}$
    & \acmd{\Verb|\decrypt{A,B}{\avar{c}}|}, where the cipher text
      \avar{c} is decrypted with an secret shared encryption key
      (in this case, a shared key between \apri{A} and \apri{B}). Other
      options are \acmd{*}, \acmd{+}, \acmd{-}, \acmd{!}
      \acmd{'}, and \acmd{"} (see above for explanation). Since
      \acmd{\Verb|\decrypt|} is a function, we can include a return value
      as an optional last argument:
      \newline
      \example{%
        \mbox{\acmd{\Verb|\decrypt-{B}{\encrypted+{B}{m}}[m]|}}\gives
        \decrypt-{B}{\encrypted+{B}{m}}[m]}\vspace*{-2.0ex}\\ \nopagebreak
      \emph{Arguments:} & \cmdargs{decrypt}{TBimmo}\newline
                          \cmdargex{decrypt}{{\cmdkarg}\cmdoarg{size}%
                          {\cmdearg}\cmdmarg{key}\cmdmarg{cipher}%
                          \cmdoarg{returns}}
    \\\hline

    % \decrypt[big]{A,B}{\avar{c}}
    % & \acmd{\Verb|\decrypt[big]{A,B}{\avar{c}}|}, where the first optional
    %   argument can be \acmd{big}, \acmd{Big}, \acmd{bigg}, or \acmd{Bigg}
    %   for increased size of parenthesis (see examples with structured values
    %   above). Typically used with nested structured values:
    %   \newline
    %   \example{%
    %   \mbox{\acmd{\Verb|\decrypt-[big]{B}{\encrypted+{B}{m}}[m]|}}%
    %   \gives \decrypt-[big]{B}{\encrypted+{B}{m}}[m]}
    %   \\\hline

    $\chash{m}$
    & \acmd{\Verb|\chash{m}|}, used for a cryptographic hash value of
      \aval{m}.\\[-1ex]\nopagebreak
      \emph{Arguments:} & \cmdargs{chash}{Bim}\newline
                          \cmdargex{chash}{\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{value}}
    \\\hline

    % \chash[big]{m}
    % & \acmd{\Verb|\chash[big]{m}|}, where the first optional argument
    %   can be \acmd{big}, \acmd{Big}, \acmd{bigg}, or \acmd{Bigg}
    %   for increased size of parenthesis (see examples with structured values
    %   above).
    % \\\hline

    $\mac{A}{m}$
    & \acmd{\Verb|\mac{A}{m}|}, used for message authentication code
      of \aval{m} with \key{A}.\\[-1ex]\nopagebreak
      \emph{Arguments:} & \cmdargs{mac}{TBimm}\newline
                          \cmdargex{mac}{{\cmdkarg}\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{key}\cmdmarg{value}}
    \\\hline

    $\cmac{A}{m}$
    & \acmd{\Verb|\cmac{A}{m}|}, used for cipher-based message 
      authentication code of \aval{m} with \key{A}.\\[-1ex]\nopagebreak
      \emph{Arguments:} & \cmdargs{cmac}{TBimm}\newline
                          \cmdargex{cmac}{{\cmdkarg}\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{key}\cmdmarg{value}}
    \\\hline

    $\hmac{A}{m}$
    & \acmd{\Verb|\hmac{A}{m}|}, used for HMAC message
      authentication code of \aval{m} with \key{A}.\\[-1ex]\nopagebreak
      \emph{Arguments:} & \cmdargs{hmac}{TBimm}\newline
                          \cmdargex{hmac}{{\cmdkarg}\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{key}\cmdmarg{value}}
    \\\hline

    $\chashf{m}$
    & \acmd{\Verb|\chashf{m}|}, used for a cryptographic hash value
      function producing the cryptographic hash value of \aval{m}.
      Since \acmd{\Verb|\chashf|} is a function, we
      can include a return value as an optional last argument:
      \newline
      \example{\mbox{\acmd{\Verb|\chashf{m}[*]|}}\gives
        \chashf{m}[*]}\vspace*{-2.0ex}\\ \nopagebreak
      \emph{Arguments:} & \cmdargs{chashf}{Bimo}\newline
                          \cmdargex{chasf}{\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{value}\cmdoarg{returns}}
    \\\hline

    % \chashf[big]{m}
    % & \acmd{\Verb|\chashf[big]{m}|}, where the first optional argument
    %   can be \acmd{big}, \acmd{Big}, \acmd{bigg}, or \acmd{Bigg}
    %   for increased size of parenthesis (see examples with structured values
    %   above).
    %   \\\hline

    $\macf{A}{m}$
    & \acmd{\Verb|\macf{A}{m}|}, used for a message authentication code
      function with the arguments \key{A} and \aval{m}.
      Since \acmd{\Verb|\macf|} is a function, we
      can include a return value as an optional last argument:
      \newline
      \example{\mbox{\acmd{\Verb|\macf{A}{m}[*]|}}\gives
        \macf{A}{m}[*]}\vspace*{-2.0ex}\\ \nopagebreak
      \emph{Arguments:} & \cmdargs{macf}{TBimmo}\newline
                          \cmdargex{macf}{{\cmdkarg}\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{key}\cmdmarg{value}\cmdoarg{returns}}
    \\\hline

    $\cmacf{A}{m}$
    & \acmd{\Verb|\cmacf{A}{m}|}, used for a cipher-based message 
      authentication code with the arguments \key{A} and \aval{m}.
      Since \acmd{\Verb|\cmacf|} is a function, we
      can include a return value as an optional last argument:
      \newline
      \example{\mbox{\acmd{\Verb|\cmacf{A}{m}[*]|}}\gives
        \cmacf{A}{m}[*]}\vspace*{-2.0ex}\\ \nopagebreak
    \emph{Arguments:} & \cmdargs{cmacf}{TBimmo}\newline
                          \cmdargex{cmacf}{{\cmdkarg}\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{key}\cmdmarg{value}\cmdoarg{returns}}
    \\\hline

    $\hmacf{A}{m}$
    & \acmd{\Verb|\hmacf{A}{m}|}, used for a HMAC message
      authentication code with the arguments \key{A} and \aval{m}.
      Since \acmd{\Verb|\hmacf|} is a function, we
      can include a return value as an optional last argument:
      \newline
      \example{\mbox{\acmd{\Verb|\hmacf{A}{m}[*]|}}\gives
        \hmacf{A}{m}[*]}\vspace*{-2.0ex}\\ \nopagebreak
    \emph{Arguments:} & \cmdargs{hmacf}{TBimmo}\newline
                          \cmdargex{hmacf}{{\cmdkarg}\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{key}\cmdmarg{value}\cmdoarg{returns}}
    \\\hline

    $\sig-{A}{m}$
    & \acmd{\Verb|\sig-{A}{m}|}, used for the signature of \apri{A}
      on \aval{m}, where the \acmd{-} says that the signature is signed
      with a private key (in this case, the private key of \apri{A}).
      The other key type markers can also be used with this command.
      % Other options are no markers, 
      % \acmd{*}, \acmd{+} (rarely used) and~\acmd{!}:
      % \newline
      % \example{%
      %   \begin{array}{lcl@{\quad}l}
      %     \mbox{\acmd{\Verb|\sig{A,B}{m}|}} & \givesarrow
      %     & \sig{A,B}{m}
      %     & \mbox{Signature from shared key \key{A,B}} \\
      %     \mbox{\acmd{\Verb|\sig*{K}{m}|}} & \givesarrow
      %     & \sig*{K}{m}
      %     & \mbox{Signature from specific key \akey{K}} \\
      %     \mbox{\acmd{\Verb|\sig+{B}{m}|}} & \givesarrow
      %     & \sig+{A}{m}
      %     & \mbox{Signature from public key \key+{A}} \\
      %     \mbox{\acmd{\Verb|\sig!{A}{m}|}} & \givesarrow
      %     & \sig!{A}{m}
      %     & \mbox{Signature signed by \apri{A}} \\
      %     \mbox{\acmd{\Verb|\sig!{A,B}{m}|}} & \givesarrow
      %     & \sig!{A,B}{m}
      %     & \mbox{Signature based on a shared secret}
      %           \end{array}}
      \\[-1ex]\nopagebreak
      \emph{Arguments:} & \cmdargs{sig}{TBimm}\newline
                          \cmdargex{sig}{{\cmdkarg}\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{key}\cmdmarg{value}}
    \\\hline

    $\sigf-{A}{m}$
    & \acmd{\Verb|\sigf-{A}{m}|}, used to create a signature of \apri{A}
      on \aval{m}, where the \Verb|-| says that the signature is signed with
      a private key (in this case, the private key of \apri{A}).
      The other key type markers can also be used with this command.
      Since \acmd{\Verb|\sigf|}
      is a function, we can include a return value as an optional last
      argument (and it supports magic return making straightforward to
      include the return value).
      \\[-1ex]\nopagebreak
      \emph{Arguments:} & \cmdargs{sigf}{TBimmx}\newline
                          \cmdargex{sigf}{{\cmdkarg}\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{key}\cmdmarg{value}\cmdoarg{returns}}
    \\\hline
    
    $\signed-{A}{m}$
    & \acmd{\Verb|\signed-{A}{m}|}, used for \aval{m} signed,
      where the \acmd{-}  
      says that the signature is signed with a private key (in this 
      case, the private key of \apri{A}).
      The other key type markers can also be used with this command.
      % Other, often used, options are
      % no marker, \acmd{*}, \acmd{+} (rarely used) and
      % \acmd{!}:
      % \newline
      % \example{%
      %   \begin{array}{lcl@{\quad}l}
      %     \mbox{\acmd{\Verb|\signed{A,B}{m}|}} & \givesarrow
      %     & \signed{A,B}{m}
      %     & \mbox{\aval{m} signed with shared key \key{A,B}} \\
      %     \mbox{\acmd{\Verb|\signed*{K}{m}|}} & \givesarrow
      %     & \signed*{K}{m}
      %     & \mbox{\aval{m} signed with specific key \akey{K}} \\
      %     \mbox{\acmd{\Verb|\signed+{A}{m}|}} & \givesarrow
      %     & \signed+{A}{m}
      %     & \mbox{\aval{m} signed with public key \key+{A}} \\
      %     \mbox{\acmd{\Verb|\signed!{A}{m}|}} & \givesarrow
      %     & \signed!{A}{m}
      %     & \mbox{\aval{m} signed by \apri{A}} \\
      %     \mbox{\acmd{\Verb|\signed!{A,B}{m}|}} & \givesarrow
      %     & \signed!{A,B}{m}
      %     & \mbox{\aval{m} signed with a shared secret}
      %   \end{array}}
      \\[-1ex]\nopagebreak
      \emph{Arguments:} & \cmdargs{signed}{TBimm}\newline
                          \cmdargex{signed}{{\cmdkarg}\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{key}\cmdmarg{value}}
    \\\hline

    $\sign-{A}{m}$
    & \acmd{\Verb|\sign-{A}{m}|}, used to sign \aval{m},
      where the \acmd{-}  
      says that the signature is signed with a private key (in this 
      case, the private key of \apri{A}).
      The other key type markers can also be used with this command.
      Since \acmd{\Verb|\sign|}
      is a function, we can include a return value as an optional last
      argument (and it supports magic return making straightforward to
      include the return value).
      \\[-1ex]\nopagebreak
      \emph{Arguments:} & \cmdargs{sign}{TBimmx}\newline
                          \cmdargex{sign}{{\cmdkarg}\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{key}\cmdmarg{value}\cmdoarg{returns}}
    \\\hline
    
    $\pwkeyf{P}(s)$
    & \acmd{\Verb|\pwkeyf{P}(s)|}, used to create a secret key from a
      password \aval{P}. Optionally, a salt value \aval{s} can be provided
      Since \acmd{\Verb|\pwkeyf|} is a function, we can include a return
      value as an optional last argument (and it supports magic return making
      straightforward to include the return value): \newline
      \example{%
      \mbox{\acmd{\Verb|\pwkeyf{P_1}(s)[*]|}}\gives\pwkeyf{P_1}(s)[*]\\
      \mbox{\acmd{\Verb|\pwkeyf{P_2}[x]|}}\gives
      \pwkeyf{P_2}[x]}\vspace*{-2.0ex}\\
    \nopagebreak
    \emph{Arguments:} & \cmdargs{pwkeyf}{sBimpx}\newline
                        \cmdargex{pwkeyf}{{\cmdsarg}\cmdoarg{size}{\cmdearg}%
                        \cmdmarg{password}\cmdparg{salt}\cmdoarg{returns}}
    \\\hline

    $\dhpubkeyf{A}(p)$
    & \acmd{\Verb|\dhpubkeyf{A}(p)|}, used to create a public key \key+{A}
      (a key share) from a private key \key-{A} and the optional public
      parameters \aval{p}, typically used in a Diffie–Hellman key exchange
      protocol~\cite{diffie1976a}.
      \newline
      \example{%
      \mbox{\acmd{\Verb|\dhpubkeyf{A}(p)[A]|}}\gives\dhpubkeyf{A}(p)[A] \\
      \mbox{\acmd{\Verb|\dhpubkeyf*{x}[y]|}}\gives\dhpubkeyf*{x}[y]}%
    \vspace*{-2.0ex}\\
    \nopagebreak
    \emph{Arguments:} & \cmdargs{dhpubkeyf}{sBimpo}\newline
                        \cmdargex{dhpubkeyf}{{\cmdsarg}\cmdoarg{size}{\cmdearg}%
                        \cmdmarg{key}\cmdparg{parms}\cmdoarg{returns}}
    \\\hline

    $\dhkeyf{A}{B}(p)$
    & \acmd{\Verb|\dhkeyf{A}{B}(p)|}, used to combine a public key \key+{A}
      with another public key \key+{B} and the optional public parameters
      \aval{p} to generate a new secret (shared) key \key{A,B}, typically
      used in a Diffie–Hellman key exchange protocol~\cite{diffie1976a}.
      \newline
      \example{%
      \mbox{\acmd{\Verb|\dhkeyf{A}{B}(p)[A,B]|}}\gives\dhkeyf{A}{B}(p)[A,B] \\
      \mbox{\acmd{\Verb|\dhkeyf*{x}{y}[z]|}}\gives\dhkeyf*{x}{y}[z]}%
    \vspace*{-2.0ex}\\
    \nopagebreak
    \emph{Arguments:} & \cmdargs{dhkeyf}{sBimmpo}\newline
                        \cmdargex{dhkeyf}{{\cmdsarg}\cmdoarg{size}{\cmdearg}%
                        \cmdmarg{key}\cmdmarg{key}\cmdparg{parms}%
                        \cmdoarg{returns}}
    \\\hline

    $\verify+{A}{\avar{s}}$
    & \acmd{\Verb|\verify+{A}{\avar{s}}|}, used to verify the signed data
      \avar{s}, where the \acmd{+} says that the signed data is 
      verified towards the public key of \apri{A}.
      The other key type markers can also be used with this command.
      \\[-1ex]\nopagebreak
      \emph{Arguments:} & \cmdargs{verify}{TBimmo}\newline
                          \cmdargex{verify}{{\cmdkarg}\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{key}\cmdmarg{value}\cmdoarg{returns}}
    \\\hline
    
    $\certificate!{C}{\apri{B},\key+{B}}$
    & \acmd{\Verb|\certificate!{C}{\apri{B},\key+{B}}|}, used for
      a certificate binding the public key \key+{B} (public key of \apri{B})
      to the principal \apri{B}, where \acmd{!}  
      says that the signature is signed by the certificate authority \apri{C}.
      The other key type markers can also be used with this command.
      \\[-1ex]\nopagebreak
      \emph{Arguments:} & \cmdargs{certificate}{TBimm}\newline
                          \cmdargex{certificate}{{\cmdkarg}\cmdoarg{size}%
                          {\cmdearg}\cmdmarg{key}\cmdmarg{content}}
    \\\hline
    
    $\cert-{C}{A}$
    & \acmd{\Verb|\cert-{C}{A}|}, used for a certificate binding the
      public key \akey+{A} (public key of \apri{A}) to the principal \apri{A}, 
      where the \acmd{-}  
      says that the signature is signed with a private key (in this 
      case, the private key of the certificate authority \apri{C}).
      The other key type markers can also be used with this command.
    \\[-1ex]\nopagebreak
    \emph{Arguments:} & \cmdargs{cert}{TBimm}\newline
                          \cmdargex{certificate}{{\cmdkarg}\cmdoarg{size}%
                          {\cmdearg}\cmdmarg{key}\cmdmarg{principal}}
    \\\hline
    
    $\mktval{X}\tvalX{m}$
    & \acmd{\Verb|\mktval{X}|}, used to create a new typed structured
      value type  where the argument is the type.  In this example, the
      result is a new {\latex} command \acmd{\Verb|\tvalX|} (created
      combining the prefix \acmd{\Verb|tval|} and the given name).  We 
      can for example use this to create a new typed structured type for a
      specific message type:\newline
      \example{%
        % \mbox{\acmd{%
        %   \Verb|\tval{KT}{\apri{S},\apri{C},\mbox{Addr},\ts{t},\ttl{l}}|}}
        % & \givesarrow
        % & \tval{KT}{\apri{S},\apri{C},\mbox{Addr},\ts{t},\ttl{l}} \\
        \begin{tabular}{@{}l@{}}
          \mbox{\acmd{\Verb|\mktval{ReqMsg}|}} \\
          \mbox{\acmd{\Verb|\tvalReqMsg{\apri{A},m}|}}
        \end{tabular}\gives
        \mktval{ReqMsg}\tvalReqMsg{\apri{A},m}%
    }\vspace*{-2.2ex}
    \\ &
       The new command will have a \acmd{\Verb|*|} version similar to the
       \acmd{\Verb|\tval*|} command (the value is not wrapped with curly
       brackets).  The \acmd{\Verb|\mktval|} has an
       optional first argument to specify the name of the command
       created:\newline
       \example{
         \begin{tabular}{@{}l@{}}
           \mbox{\acmd{\Verb|\mktval[reqmsg]{RMsg}|}} \\
           \mbox{\acmd{\Verb|\reqmsg{m}|}}
         \end{tabular}\gives
         \mktval[reqmsg]{RMsg}\reqmsg{m}}\vspace*{-2.0ex}\\ \nopagebreak
      \emph{Arguments:} & \cmdargs{mktval}{om}[sBim]\newline
                          \cmdargex{mktval}{\cmdoarg{cmd}\cmdmarg{type}}%
                          [\cmdargexx{cmd}{{\cmdsarg}\cmdoarg{size}%
                          {\cmdearg}\cmdmarg{value}}]
    \\\hline

    $\mketval{X}\etvalX{A}{m}$
    & \acmd{\Verb|\mketval{X}|}, used to create a new \emph{encrypted}
      typed structured value type where the argument is the type.  In this
      example, the result is a new {\latex} command \acmd{\Verb|\etvalX|}
      (created combining the prefix \acmd{\Verb|etval|} and the given name).
      We can for example use this to create a new typed structured type
      for an encrypted message type:\newline
      \example{%
        \begin{tabular}{@{}l@{}}
          \mbox{\acmd{\Verb|\mketval{EMsg}|}} \\
          \mbox{\acmd{\Verb|\etvalEMsg'{C,S}{m}|}}
        \end{tabular}\gives
      \mketval{EMsg}\etvalEMsg'{C,S}{m}}\vspace*{-2.2ex}\\
    &
      The \acmd{\Verb|\mketval|} has an
      optional first argument to specify the name of the command
      created (here we define the command \acmd{\Verb|\aka|} for
      Kerberos Authenticators):\newline
      \example{%
        \begin{tabular}{@{}l@{}}
          \mbox{\acmd{\Verb|\mketval[aka]{KA}|}} \\
          \mbox{\acmd{%
            \Verb|\aka'{S,C}{\apri{C},\textit{Addr}_C,\ts{s}}|}}
        \end{tabular}\gives
      \mketval[aka]{KA}\aka'{S,C}{\apri{C},\textit{Addr}_C,\ts{s}}}%
      \vspace*{-2.2ex}\\
    &
      In this case, it might be a good idea to create a new {\latex} 
      command \acmd{\Verb|\ka|} implemented with \acmd{\Verb|\aka|}
      and the proper arguments (implementation details not shown):\newline
      \example{%
        \begin{tabular}{@{}l@{}}
          \mbox{\acmd{\Verb|\newcommand{\ka}[3]{\aka'{...}}|}}\\
          \mbox{\acmd{\Verb|\ka{S,C}{C}{s}|}}
        \end{tabular}\gives
        \mketval[aka]{KA}%
        \NewDocumentCommand\ka{mmm}{\aka'{#1}{%
        \apri{#2},\textit{Addr}_{\apri{#2}},\ts{#3}}}%
        \ka{S,C}{C}{s}%
      }\vspace*{-2.0ex}\\ \nopagebreak
      \emph{Arguments:} & \cmdargs{mketval}{om}[TBimm]\newline
                          \cmdargex{mketval}{\cmdoarg{cmd}\cmdmarg{type}}%
                          [\cmdargexx{cmd}{{\cmdkarg}\cmdoarg{size}%
                          {\cmdearg}\cmdmarg{key}\cmdmarg{value}}]
    \\\hline

    $\mkstval{X}\stvalX{A}{m}$
    & \acmd{\Verb|\mkstval{X}|}, used to create a new \emph{signed}
      typed structured
      value type where the argument is the type.  In this example, the
      result is a new {\latex} command \acmd{\Verb|\stvalX|} (created
      combining the prefix \acmd{\Verb|stval|} and the given name).  We can for
      example use this to create a new typed structured type for an
      signed message type:\newline
      \example{%
        % \mbox{\acmd{%
        %   \Verb|\tval{KT}{\apri{S},\apri{C},\mbox{Addr},\ts{t},\ttl{l}}|}}
        % & \givesarrow
        % & \tval{KT}{\apri{S},\apri{C},\mbox{Addr},\ts{t},\ttl{l}} \\
        \begin{tabular}{@{}l@{}}
          \mbox{\acmd{\Verb|\mkstval{SMsg}|}} \\
          \mbox{\acmd{\Verb|\stvalSMsg-{A}{m}|}}
        \end{tabular}\gives
        \mkstval{SMsg}\stvalSMsg-{A}{m}}\vspace*{-2.2ex}
    \\ &
       The \acmd{\Verb|\mkstval|} has an
       optional first argument to specify the name of the command
       created:\newline
         \example{%
        \begin{tabular}{@{}l@{}}
          \mbox{\acmd{\Verb|\mkstval[smsg]{SMsg}|}} \\
          \mbox{\acmd{\Verb|\smsg-{S}{m}|}}
        \end{tabular}\gives
        \mketval[smsg]{SMsg}\smsg-{S}{m}}\vspace*{-2.0ex}\\ \nopagebreak
      \emph{Arguments:} & \cmdargs{mkstval}{om}[TBimm]\newline
                          \cmdargex{mkstval}{\cmdoarg{cmd}\cmdmarg{type}}%
                          [\cmdargexx{cmd}{{\cmdkarg}\cmdoarg{size}%
                          {\cmdearg}\cmdmarg{key}\cmdmarg{value}}]
    \\\hline

    $\mkfunc{X}\funcX{x,y}$
    & \acmd{\Verb|\mkfunc{X}|}, used when creating a new function type
      where the argument is the name of the function type.  In this example
      the result is a new {\latex} command \acmd{\Verb|\funcX|} (created
      combining the prefix \acmd{\Verb|func|} and the given name).
      We can for example use this to create a new function type
      for a creating a Kerberos Authenticator:\newline
      \example{%
        % \mbox{\acmd{%
        %   \Verb|\tval{KT}{\apri{S},\apri{C},\mbox{Addr},\ts{t},\ttl{l}}|}}
        % & \givesarrow
        % & \tval{KT}{\apri{S},\apri{C},\mbox{Addr},\ts{t},\ttl{l}} \\
        \begin{tabular}{@{}l@{}}
          \mbox{\acmd{\Verb|\mkfunc{KA}|}} \\
          \mbox{\acmd{\Verb|\funcKA{\apri{C},\textit{Addr}_C,\ts{s}}|}}
        \end{tabular}\gives
        \mkfunc{KA}\funcKA{\apri{C},\textit{Addr}_C,\ts{s}}}\vspace*{-2.2ex}
    \\
    & The \acmd{\Verb|\mkfunc|} has an optional first argument to specify
      the name of the command created:\newline
      \example{%
        \begin{tabular}{@{}l@{}}
          \mbox{\acmd{\Verb|\mkfunc[kaf]{KA}|}} \\
          \mbox{\acmd{\Verb|\kaf{\apri{C},\textit{Addr}_C,\ts{s}}|}}
        \end{tabular}\gives
      \mkfunc[kaf]{KA}\kaf{\apri{C},\textit{Addr}_C,\ts{s}}}\vspace*{-2.2ex}
    \\
    & The \acmd{\Verb|\mkfunc|} has an optional third and last argument to
      specify the name of the command used for magic return:\newline
      \example{%
        \begin{tabular}{@{}l@{}}
          \mbox{\acmd{\Verb|\mktval[aset]{Set}]|}} \\
          \mbox{\acmd{\Verb|\mkfunc[asetf]{Set}[aset]|}} \\
          \mbox{\acmd{\Verb|\asetf{\aval{x},\aval{y}}[*]|}}
        \end{tabular}\gives
        \mktval[aset]{Set} \mkfunc[asetf]{Set}[aset]%
        \asetf{\aval{x},\aval{y}}[*]}\vspace*{-2.0ex}
      \\ \nopagebreak
      \emph{Arguments:} & \cmdargs{mkfunc}{omo}[Bimx]\newline
                          \cmdargex{mkfunc}{%
                          \cmdoarg{cmd}\cmdmarg{name}\cmdoarg{magic-return}}%
                          [\cmdargexx{cmd}{\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{arguments}\cmdoarg{returns}}]
    \\\hline

    $\mkkfunc{X}\funcX{A}{x,y}$
    & \acmd{\Verb|\mkkfunk{X}|}, used when creating a new function type for
      functions where the first argument is an encryption key.  The
      argument is the name of the function type.  In this example
      the result is a new {\latex} command \acmd{\Verb|\funcX|} (created
      combining the prefix \acmd{\Verb|func|} and the given name) with two
      arguments; the first argument is an encryption key and the second
      argument is a comma separated list of the rest of the function arguments.
      We can for example use this to create this new function type with an
      encryption key as the first argument (a session key in this
      example):\newline
      \example{%
        % \mbox{\acmd{%
        %   \Verb|\tval{KT}{\apri{S},\apri{C},\mbox{Addr},\ts{t},\ttl{l}}|}}
        % & \givesarrow
        % & \tval{KT}{\apri{S},\apri{C},\mbox{Addr},\ts{t},\ttl{l}} \\
        \begin{tabular}{@{}l@{}}
          \mbox{\acmd{\Verb|\mkkfunc{KeyF}|}} \\
          \mbox{\acmd{\Verb|\funcKeyF'{A}{\textit{Addr},\ts{s}}|}}
        \end{tabular}\gives
        \mkkfunc{KeyF}\funcKeyF'{A}{\textit{Addr},\ts{s}}}\vspace*{-2.2ex}
    \\ &
      The \acmd{\Verb|\mkkfunc|} has an optional first argument to specify
      the name of the command created:\newline
      \example{%
        \begin{tabular}{@{}l@{}}
          \mbox{\acmd{\Verb|\mkkfunc[kf]{KeyF}|}} \\
          \mbox{\acmd{\Verb|\kf'{A}{\textit{Addr},\ts{s}}|}}
        \end{tabular}\gives
      \mkkfunc[kf]{KeyF}\kf'{A}{\textit{Addr},\ts{s}}}\vspace*{-2.2ex}
    \\
    & The \acmd{\Verb|\mkkfunc|} has an optional third and last argument to
      specify the name of the command used for magic return:\newline
      \example{%
        \begin{tabular}{@{}l@{}}
          \mbox{\acmd{\Verb|\mkstval[sset]{SSet}]|}} \\
          \mbox{\acmd{\Verb|\mkkfunc[ssetf]{SignSet}[sset]|}} \\
          \mbox{\acmd{\Verb|\ssetf-{A}{\aval{x},\aval{y}}[*]|}}
        \end{tabular}\gives
        \mkstval[sset]{SSet} \mkkfunc[ssetf]{SignSet}[sset]%
        \ssetf-{A}{\aval{x},\aval{y}}[*]}\vspace*{-2.0ex}
      \\ \nopagebreak
      \emph{Arguments:} & \cmdargs{mkkfunc}{omo}[TBimmx]\newline
                          \cmdargex{mkkfunc}{%
                          \cmdoarg{cmd}\cmdmarg{name}\cmdoarg{magic-return}}%
                          [\cmdargexx{cmd}{{\cmdkarg}\cmdoarg{size}{\cmdearg}%
                          \cmdmarg{key}\cmdmarg{arguments}\cmdoarg{returns}}]
    \\\Xhline{0.5pt}

  \end{xltabular}}


%\clearpage
\subsection{BAN logic}
\label{sec:latex-ban}

The table below lists the BAN logic notation with the matching
{\latex} commands. This notation is available when the {\latex}
package \acmd{aspen} is loaded with the option \acmd{ban}.

{\renewcommand{\arraystretch}{1.6}
  \begin{xltabular}{\textwidth}{l@{\hspace{.8em}}X}\Xhline{0.5pt}

    \textbf{Notation}
    & \textbf{{\latex} code and description}
    \\\Xhline{0.5pt}

    \believes
    & \acmd{\Verb|\believes|}, used to state that someone \emph{believes}
      something (and acts as it is true):
      \newline
      \example{\mbox{\acmd{\Verb|\apri{A}\believes\aval{X}|}}\gives
      \apri{A}\believes\aval{X}}
    \\\hline

    \sees
    & \acmd{\Verb|\sees|}, used to state that someone sees something
      (Someone has sent a message to someone and they have bee able to 
      read it):
      \newline
      \example{\mbox{\acmd{\Verb|\apri{A}\sees\aval{X}|}}\gives
      \apri{A}\sees\aval{X}}
    \\\hline

    \oncesaid
    & \acmd{\Verb|\oncesaid|}, used to state to someone at some time said
      something (someone some time sent a message including the statement):
      \newline
      \example{\mbox{\acmd{\Verb|\apri{A}\oncesaid\aval{X}|}}\gives
      \apri{A}\oncesaid\aval{X}}
    \\\hline

    \controls
    & \acmd{\Verb|\controls|}, used to state that someone has
      \emph{jurisdiction} (controls) over something:
      \newline
      \example{\mbox{\acmd{\Verb|\apri{A}\controls\aval{X}|}}\gives
      \apri{A}\controls\aval{X}}
    \\\hline

    \fresh{X}
    & \acmd{\Verb|\fresh{X}|}, used to state that something is fresh
      (\aval{X} has not been sent in a message at any time before in the
      current run of the protocol).
    \\\hline

    \asharedkey{K}
    & \acmd{\Verb|\asharedkey{K}|}, used to state that a key is shared:
      \newline
      \example{\mbox{\acmd{\Verb|\apri{A}\asharedkey{\key{A,B}}\apri{B}|}}\gives
      \apri{A}\asharedkey{\key{A,B}}\apri{B}}
    \\\hline      

    \thepubkey{K}
    & \acmd{\Verb|\thepubkey{K}|}, used to state that a key is a
      public key of someone:
      \newline
      \example{\mbox{\acmd{\Verb|\thepubkey{\key+{A}}\apri{A}|}}\gives
      \thepubkey{\key+{A}}\apri{A}}
    \\\hline   

    \asecret{X}
    & \acmd{\Verb|\asecret{X}|}, used to state that a secret
      (\aval{X}, in this case) is only known to them:
      \newline
      \example{\mbox{\acmd{\Verb|\apri{A}\asecret{X}\apri{B}|}}\gives
      \apri{A}\asecret{X}\apri{B}}
    \\\hline

    \encryptedwith{K}{X}
    & \acmd{\Verb|\encryptedwith{K}{X}|}, used to state that something is
      encrypted with the key (\aval{X} is encrypted with the key \akey{K}).
    \\\hline

    \combine{x}{y}
    & \acmd{\Verb|\combine{x}{y}|}, used to state that $x$ is combined
      with $y$:
      \newline
      \example{\mbox{\acmd{\Verb|\combine{\aval{X}}{\aval{Y}}|}}\gives
      \combine{\aval{X}}{\aval{Y}}}
    \\\Xhline{0.5pt}

  \end{xltabular}}
    

%\clearpage
\subsection{Series of steps}
\label{sec:latex-steps}

The {\latex} package \acmd{aspen} provides support for presenting a
security protocol as a series of messages and steps with the
\acmd{steps} environment.  A message between to principals is in the
\acmd{steps} environment typeset with the familiar \acmd{\Verb|\send|}
command.  With \acmd{\Verb|\send|} commands, the \acmd{steps}
environment can be used like this:

\begin{ltxexample}{230pt}
  \begin{steps}
    \send*{A}{B}{\encrypted+{B}{m_1}}[m1] \\
    \send*{B}{A}{\encrypted+{A}{m_2}}[m2]
  \end{steps}
\end{ltxexample}

Notice that each step is separated by the \acmd{\Verb|\\|}
command. Each step is labeled and can be referred to by its name
(\acmd{\Verb|\aref{m1}|} {\givesarrow} \aref{m1}, and
\acmd{\Verb|\aref{m2}|} {\givesarrow} \aref{m2}).  The \acmd{steps*}
version of the environment is without the labels:

\begin{ltxexample}{209pt}
  \begin{steps*}
    \send*{A}{B}{\encrypted+{B}{m_1}} \\
    \send*{B}{A}{\encrypted+{A}{m_2}}
  \end{steps*}
\end{ltxexample}

By default, the \acmd{steps} environment has two types of labels;
\acmd{M} for messages and \acmd{S} for other steps.  In the example
above only messages (\acmd{\Verb|\send|} commands) are used.  Other
steps are given with the \acmd{\Verb|\astep|} or the
\acmd{\Verb|\astepat|} commands.  In the following example the
\acmd{\Verb|\astep|} command is used and the space between the label
and the step is adjusted with the optional key-value argument
\acmd{lspace} (the default value is \acmd{1.5em}):

\begin{ltxexample}{182pt}
  \begin{steps}[lspace=1em]
    \astep{\encrypt+{B}{m_1}[*]} \\
    \astep{\sign-[big]{A}{%
        \encrypted+{B}{m_1}}[*]}
  \end{steps}
\end{ltxexample}

The optional key-value argument \acmd{rmarg} sets the right margin
width of the steps environment and \acmd{lmarg} sets the left margin
width of the steps environment.  The default margin widths are
\acmd{\Verb|\tabcolsep|}.  In the following example the margins are
removed:

\begin{ltxexample}{190pt}
  \begin{steps*}[lmarg=0pt,rmarg=0pt]
    \astep{No margins}
  \end{steps*}
\end{ltxexample}

We can also change the margins, and the space between the label and
the step, by adjusting the lengths \acmd{\Verb|\stepsleftmargin|},
\acmd{\Verb|\stepsrightmargin|} and \acmd{\Verb|\stepslabelspace|}.
To change these values for the whole document we can place these
commands at the beginning of the {\latex} file (after the {\latex}
package \acmd{aspen} is loaded):

\begin{ltxexample*}{178pt}
  \setlength{\stepsleftmargin}{0pt}
  \setlength{\stepsrightmargin}{0pt}
  \setlength{\stepslabelspace}{1em}
\end{ltxexample*}

The \acmd{\Verb|\astepat|} command can be used to specified
\emph{where} a step is performed.  The command has an extra first
argument where this is specified (in this example, at principal
\apri{A}):

\begin{ltxexample}{190pt}
  \begin{steps}*
    \astepat{A}{\sign-{A}{m_1}[*]} \\
    \astepat{A}{\encrypt+[big]{B}{%
        \signed-{A}{m_1}}[*]}
  \end{steps}  
\end{ltxexample}

The \acmd{*} marker of the \acmd{steps} environment (not to be
confused with the \acmd{steps*} version of the environment) means that
the counters of the labels are \emph{not} reset (the counting
continues from the previous \acmd{steps} environment).  It is also
possible to set the value of each counter using the standard {\latex}
command \acmd{\Verb|\setcounter|}.  For example, if you want the
counter of the \acmd{S} labels to start with zero, you add this as the
first command inside a \acmd{steps} environment:
\acmd{\Verb|\setcounter{counterS}{-1}|} (see \refltxcode{smc-mean} for
an example).

It is also possible to add new types of labels with the optional
key-value argument \acmd{labels}.  In this example, new label types
\acmd{A} and \acmd{B} are introduced and the \acmd{\Verb|\astepat|}
commands are labeled with the new label types by using the optional
first argument to the command:

\begin{ltxexample}{220pt}
  \begin{steps}[labels={A,B}]
    \astepat(A){A}{\encrypt+{B}{m_1}[*]} \\
    \send*{A}{B}{\encrypted+{B}{m_1}} \\
    \astepat(B){B}{\decrypt-[big]{B}{%
        \encrypted+{B}{m_1}}[m_1]}
  \end{steps}  
\end{ltxexample}

The \acmd{\Verb|\astepat*|} version of the \acmd{\Verb|\astepat|} command changes the
horizontal position of the text of such steps so the colons are
aligned:

\begin{ltxexample}{242pt}
  \begin{steps*}
    \send*{A}{B}{\signed-{A}{m_1}} \\
    \astepat*{B}{\verify+{A}{\signed-{A}{m_1}}}
  \end{steps*}
\end{ltxexample}

The \acmd{\Verb|\astep*|} version of the \acmd{\Verb|\astep|} command
changes the horizontal position of the text of the step in a similar
way:

\begin{ltxexample}{215pt}
  \begin{steps*}
    \send*{A}{B}{\signed-{A}{m_1}} \\
    \astep*{\verify+{A}{\signed-{A}{m_1}}}
  \end{steps*}
\end{ltxexample}

The \acmd{\Verb|\arawstep|} command is a low-level command that 
usually is not necessary. In a \acmd{steps*} environment it has four
optional arguments followed by one non-optional argument. In a
\acmd{steps} environment another optional first argument and an
optional last argument is added related to the labels of the step. To
better understand the command we show it here used together with a
\acmd{\Verb|\send|} command in a \acmd{steps} environment:

\begin{ltxexample}{184pt}
  \begin{steps}
    \send{A}{B}{m}[s1] \\
    \arawstep(M)[a][--][b][;]{m}[s2]
  \end{steps}
\end{ltxexample}

% The last optional argument of the commands \acmd{\Verb|\send|} and
% \acmd{\Verb|\arawstep|} is a label name that we can use to refer to these
% steps, \aref{s1} and \aref{s2} in this case. The first optional argument
% of \acmd{\Verb|\arawstep|} is the label type for this step. The \acmd{steps}
% environment has two default label types, \acmd{S} for the steps
% commands and \acmd{M} for the send commands (messages). In the example,
% the \acmd{\Verb|\arawstep|} command uses the \acmd{M} label type instead of the
% default S label type. The next five arguments (four optional arguments
% and one non-optional argu- ment) illustrate how the \acmd{\Verb|\arawstep|}
% command can be used to place elements at the diﬀerent horizontal
% positions of a line representing one step in \acmd{steps} or
% \acmd{steps*} environments.

% \begin{center}
%   \begin{minipage}[c]{0.49\linewidth}
% \begin{minted}{latex}
% \begin{steps}
%   \astepat{A}{\encrypt+{B}{m_1}[]} \\
%   \send*{A}{B}{\encrypted+{B}{m_1}} \\
%   \astepat{B}{\decrypt-[big]{B}{%
%     \encrypted+{B}{m_1}}[m_1]} \\
%   \astepat{B}{\encrypt+{A}{m_2}[*]} \\
%   \send*{B}{A}{\encrypted+{A}{m_2}} \\
%   \astepat{A}{\decrypt-[big]{A}{%
%     \encrypted+{A}{m_2}}[m_2]}
% \end{steps}  
% \end{minted}
%   \end{minipage}\gives
%   \begin{steps}
%     \astepat{A}{\encrypt+{B}{m_1}[*]} \\
%     \send*{A}{B}{\encrypted+{B}{m_1}} \\
%     \astepat{B}{\decrypt-[big]{B}{%
%         \encrypted+{B}{m_1}}[m_1]} \\
%     \astepat{B}{\encrypt+{A}{m_2}[*]} \\
%     \send*{B}{A}{\encrypted+{A}{m_2}} \\
%     \astepat{A}{\decrypt-[big]{A}{%
%         \encrypted+{A}{m_2}}[m_2]}
%   \end{steps}  
% \end{center}

% The arguments specification for the commands for the \acmd{steps*} and
% \acmd{step} environments:

{\renewcommand{\arraystretch}{1.6}%
  \begin{xltabular}{\textwidth}{@{}l@{\hspace{.8em}}X@{}}
    \multicolumn{2}{@{}l@{}}{%
    \textbf{The arguments of the commands in the \acmd{steps*} environment}}
    \\
     & \cmdargs{send}{sBmmm}\newline
       \cmdargex{send}{\cmdsarg\cmdoarg{size}\cmdmarg{sender}%
       \cmdmarg{receiver}\cmdmarg{message}}
    \\
     & \cmdargs{astep}{sm}\newline
       \cmdargex{astep}{\cmdsarg\cmdmarg{step}}
    \\
     & \cmdargs{astepat}{smm}\newline
       \cmdargex{astepat}{\cmdsarg\cmdmarg{where}\cmdmarg{step}}
    \\
     & \cmdargs{arawstep}{oooom}\newline
       \cmdargex{arawstep}{\cmdoarg{sender}\cmdoarg{arrow}\cmdoarg{receiver}%
       \cmdoarg{colon}\cmdmarg{step}}
  \end{xltabular}}\vspace*{-1.5\baselineskip}

{\renewcommand{\arraystretch}{1.6}%
  \begin{xltabular}{\textwidth}{@{}l@{\hspace{.8em}}X@{}}
    \multicolumn{2}{@{}l@{}}{%
    \textbf{The arguments of the commands in the \acmd{steps} environment}}
    \\
     & \cmdargs{send}{sP{M}Bmmmo}\newline
       \cmdargex{send}{\cmdsarg\cmdparg{type}\cmdoarg{size}\cmdmarg{sender}%
       \cmdmarg{receiver}\cmdmarg{message}\cmdoarg{label}}
    \\
     & \cmdargs{astep}{sP{S}mo}\newline
       \cmdargex{astep}{\cmdsarg\cmdparg{type}%
       \cmdmarg{step}\cmdoarg{label}}
    \\
     & \cmdargs{astepat}{sP{S}mmo}\newline
       \cmdargex{astepat}{\cmdsarg\cmdparg{type}\cmdmarg{where}%
       \cmdmarg{step}\cmdoarg{label}}
    \\
     & \cmdargs{arawstep}{P{S}oooomo}\newline
       \cmdargex{arawstep}{\cmdparg{type}\cmdoarg{sender}\cmdoarg{arrow}%
       \cmdoarg{receiver}\cmdoarg{colon}\cmdmarg{step}\cmdoarg{label}}
  \end{xltabular}}
 


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\clearpage
\section{Notation usage examples}
\label{sec:ex-notation-usage}

To illustrate the usability of the notation, we provide a few examples
where the notation is used to describe well-known, and not so
well-known, security protocols.  In the original papers referred to
below, you will find the original notations used.  The inconsistencies
in the notations used in these papers are a major motivation behind
{\aspen}.  The following examples are presented here:

{\tableoflisting}

The three last examples listed are from my own publications.  I have
included them since they represent the start of my process developing
this notation.  You will find that my use of notations then was a
mixed bag without consistency across publications.


\tol{org-ns}{Original Needham–Schroeder protocol}
The \emph{Needham–Schroeder protocol}~\cite{needham1978a} aims to
establish a session key between two parties on a network, typically to
protect further communication.  The protocol is based on a symmetric
encryption and it forms the basis for the Kerberos protocol (the
\emph{Needham–Schroeder public key protocol} is presented on
page~\pageref{ns-pk-ex}).

\begin{ltxex}{org-ns}{Original Needham–Schroeder protocol}
  \begin{steps}
    \send{A}{S}{\apri{A}, \apri{B}, \nonce{A}}[ons:1] \\
    \send*{S}{A}{\encrypted[big]{A,S}{\nonce{A}, \apri{B},
        \key{A,B}, \encrypted{B,S}{\key{A,B}, \apri{A}}}}[ons:2] \\
    \send*{A}{B}{\encrypted{B,S}{\key{A,B}, \apri{A}}}[ons:3] \\
    \send*{B}{A}{\encrypted{A,B}{\nonce{B}}}[ons:4] \\
    \send*{A}{B}{\encrypted{A,B}{\nonce{B} - 1}}[ons:5]
  \end{steps}
\end{ltxex}

\nonce{A} and \nonce{B} are nonces and the shared key \key{A,B} should
be fresh, \fresh{\key{A,B}}.  The protocol is vulnerable to a replay
attack~\cite{denning1981a}.  See \refltxcode{org-ns} for the {\latex}
code.


\tol{rev-ns}{Revised Needham–Schroeder protocol}
The \emph{Revised Needham–Schroeder protocol}~\cite{needham1987a}
addresses a weakness in the protocol related to its vulnerable to a
replay attack.  A fun fact regarding this suggested revision is its
link to my home department,
\href{https://en.uit.no/enhet/ifi}{Department of Computer Science} at
UiT\footnote{UiT The Arctic University of Norway, formerly University
  of Tromsø}.  From~\cite{needham1987a}:

\begin{quote}
  \emph{In 1986 one of us (RMN) gave a lecture at the University of
    Tromsø which included the 1978 protocol, the criticism of it, and
    also a general principle about the use of nonce identifiers.  This
    was that the identifier should always be generated by the party
    that sought reassurance about the time integrity of a transaction.
    In discussion Dr Sape J. Mullender of CWI Amsterdam pointed out
    that this should apply to the reassurance of B against the attack
    outlined.}
\end{quote}

The revised version adds two initial messages, \aref{rns:1} and
\aref{rns:2}, between the two principals \apri{A} and \apri{B} and the
extra nonce \nonce{I} as an identifier of the session:

\begin{ltxex}{rev-ns}{Revised Needham–Schroeder protocol}
  \begin{steps}
    \send{A}{B}{\apri{A}}[rns:1] \\
    \send*{B}{A}{\encrypted{B,S}{\apri{A},\nonce{I}}}[rns:2] \\    
    \send[big]{A}{S}{\apri{A}, \apri{B}, \nonce{A},
      \encrypted{B,S}{\apri{A},\nonce{I}}}[rns:3] \\
    \send*{S}{A}{\encrypted[big]{A,S}{\nonce{A}, \apri{B},
        \key{A,B}, \encrypted{B,S}{\key{A,B}, \apri{A}, \nonce{I}}}}[rns:4] \\
    \send*{A}{B}{\encrypted{B,S}{\key{A,B}, \apri{A}, \nonce{I}}}[rns:5] \\
    \send*{B}{A}{\encrypted{A,B}{\nonce{B}}}[rns:6] \\
    \send*{A}{B}{\encrypted{A,B}{\nonce{B} - 1}}[rns:7]
  \end{steps}
\end{ltxex}

The inclusion of the new nonce \nonce{I} prevents any replaying of
compromised versions of the message
\encrypted{B,S}{\key{A,B},\apri{A}} since the revised version of the
message contains \nonce{I}:
\encrypted{B,S}{\key{A,B},\apri{A},\nonce{I}}.  This can not be forged
since an attacker does not have ⁠\key{B,S}.  ⁠See \refltxcode{rev-ns}
for the {\latex} code of the protocol.


\tol{otway-rees}{Otway-Rees protocol}
The \emph{Otway-Rees protocol}~\cite{otway1987a} is
essential the same as the Revised Needham-Schroeder protocol:

\begin{ltxex}{otway-rees}{Otway-Rees protocol}
  \begin{steps}
    \send[big]{A}{B}{\counter{A}, \apri{A}, \apri{B},
      \encrypted{A,S}{\nonce{A}, \counter{A}, \apri{A}, \apri{B}}}[or:1] \\
    \send[big]{B}{S}{\counter{A}, \apri{A}, \apri{B},
      \encrypted{A,S}{\nonce{A}, \counter{A}, \apri{A}, \apri{B}},
      \encrypted{B,S}{\nonce{B}, \counter{A}, \apri{A}, \apri{B}}}[or:2] \\
    \send[big]{S}{B}{\counter{A},
      \encrypted{A,S}{\nonce{A}, \key'{A,B}},
      \encrypted{B,S}{\nonce{B}, \key'{A,B}}}[or:3] \\
    \send[big]{B}{A}{\counter{A},
      \encrypted{A,S}{\nonce{A}, \key'{A,B}}}[or:4]
  \end{steps}
\end{ltxex}

The identifier \counter{A} prevents the replay attack since an
attacker is not able to alter \encrypted{A,S}{\nonce{A}, \counter{A},
  \apri{A}, \apri{B}} and \encrypted{B,S}{\nonce{B}, \counter{A},
  \apri{A}, \apri{B}}.  See \refltxcode{otway-rees} for the {\latex}
code.


\tol{kerberos}{Kerberos protocol}
The \emph{Kerberos protocol}~\cite{steiner1988a} is based on the
Needham-Schroeder protocol, but makes use of timestamps as nonces to
remove the problems of the original Needham-Schroeder protocol and to
reduce the number of messages needed:

\begin{ltxex}{kerberos}{Kerberos protocol}
  \begin{steps}
    \send{A}{S}{\apri{A}, \apri{B}} \\
    \send*{S}{A}{\encrypted[big]{A,S}{\ts{s}, \ttl{}, \key{A,B},
        \apri{B}, \encrypted{B,S}{\ts{s}, \ttl{}, \key{A,B}, \apri{A}}}} \\
    \send[big]{A}{B}{\encrypted{B,S}{\ts{s}, \ttl{}, \key{A,B},
        \apri{A}}, \encrypted{A,B}{\apri{A}, \ts{a}}} \\
    \send*{B}{A}{\encrypted{A,B}{\ts{a} + 1}}
  \end{steps}
\end{ltxex}

\ats{T_s} and \ats{T_a} are timestamps and \ats{L} is a lifetime.  See
\refltxcode{kerberos} for the {\latex} code.


\tol{dh-ke}{Diffie–Hellman key exchange}
The \emph{Diffie–Hellman key exchange}
protocol~\cite{diffie1976a} is used to establish a shared symmetric
key between two participants over a public channel based a secret (a
private key) at each participant and some shared public parameters:

\begin{ltxex}{dh-ke}{Diffie–Hellman key exchange}
  \begin{steps}
    \send{A}{B}{\aval{p}}[dh-ex:1] \\
    \astepat*{A}{\dhpubkeyf{A}(p)[A]}[dh-ex:2] \\
    \astepat*{B}{\dhpubkeyf{B}(p)[B]}[dh-ex:3] \\
    \send{A}{B}{\key+{A}}[dh-ex:4] \\
    \send{B}{A}{\key+{B}}[dh-ex:5] \\
    \astepat*{A}{\dhkeyf{A}{B}(p)[A,B]}[dh-ex:6] \\
    \astepat*{B}{\dhkeyf{B}{A}(p)[A,B]}[dh-ex:7]
  \end{steps}
\end{ltxex}

The public keys created in step \ref{dh-ex:2} and \ref{dh-ex:3} are also called
Diffie-Hellman key shares.  At the end of this protocol the two participants
\apri{A} and \apri{B} has a shared secret key \key{A,B}.  In BAN logic, we can
state the following about the outcome \key{A,B}:
\[
  \apri{A}\asharedkey{\key{A,B}}\apri{B}
\]
In step \ref{dh-ex:1} above, participant \apri{A} send the public
parameters \aval{p} to participant \apri{B}.  Other means of agreeing
on these parameters are possible and not important for the protocol
itself.  See \refltxcode{dh-ke} for the {\latex} code of the
\emph{Diffie–Hellman key exchange} protocol.


\tol{ns-pk}{Needham–Schroeder public key protocol}
The \emph{Needham–Schroeder public key protocol}~\cite{needham1978a}
intends to provide mutual authentication between two parties:

\begin{ltxex}{ns-pk}{Needham–Schroeder public key protocol}
  \begin{steps}
    \send{A}{S}{\apri{A}, \apri{B}}[ns-pk:1] \\
    \send*{S}{A}{\signed-{S}{\key+{B},\apri{B}}}[ns-pk:2] \\
    \send*{A}{B}{\encrypted+{B}{\nonce{A},\apri{A}}}[ns-pk:3] \\
    \send{B}{S}{\apri{B}, \apri{A}}[ns-pk:4] \\
    \send*{S}{B}{\signed-{S}{\key+{A},\apri{A}}}[ns-pk:5] \\
    \send*{B}{A}{\encrypted+{A}{\nonce{A},\nonce{B}}}[ns-pk:6] \\
    \send*{A}{B}{\encrypted+{B}{\nonce{B}}}[ns-pk:7]
  \end{steps}
\end{ltxex}
\label{ns-pk-ex}

This protocol is vulnerable to a man-in-the-middle
attack~\cite{lowe1995a}.  The fix is however easy.


\tol{nsl-pk}{Needham–Schroeder-Lowe public key protocol}
To avoid a man-in-the-middle attack, the \emph{Needham–Schroeder-Lowe
  public key protocol}~\cite{lowe1995a} includes the identity of the
responder in message \ref{ns-pk:6} of the protocol:

\begin{ltxex}{nsl-pk}{Needham–Schroeder-Lowe public key protocol}
  \begin{steps}
    \send{A}{S}{\apri{A}, \apri{B}}[nsl-pk:1] \\
    \send*{S}{A}{\signed-{S}{\key+{B},\apri{B}}}[nsl-pk:2] \\
    \send*{A}{B}{\encrypted+{B}{\nonce{A},\apri{A}}}[nsl-pk:3] \\
    \send{B}{S}{\apri{B}, \apri{A}}[nsl-pk:4] \\
    \send*{S}{B}{\signed-{S}{\key+{A},\apri{A}}}[nsl-pk:5] \\
    \send*{B}{A}{\encrypted+{A}{\nonce{A},\nonce{B},\apri{B}}}[nsl-pk:6] \\
    \send*{A}{B}{\encrypted+{B}{\nonce{B}}}[nsl-pk:7]
  \end{steps}
\end{ltxex}

See \refltxcode{ns-pk} and \refltxcode{nsl-pk} for the {\latex} code
of the \emph{Needham–Schroeder public key protocol} and the
\emph{Needham–Schroeder-Lowe public key protocol}.


\tol{asw}{ASW protocol} 
The \emph{ASW protocol} is an optimistic fair-exchange protocol for
contract signing~\cite{asokan1998a}.  This is a good example for
{\aspen} since we in publications find very different (and, if I may
say so, hard to read) notations used when presenting the
protocol~\cite{asokan1998a,briais2007a}.  This is a simplified version
of the \emph{exchange} subprotocol (the main part of the protocol) of
ASW is shown in {\aspen}:

\begin{ltxex}{asw}{ASW exchange protocol}
  \begin{steps}
    \send*{O}{R}{\signed-[big]{O}{%
        \key+{A},\key+{B},m,\chash{\nonce{O}}}}[asW:1] \\
    \send*{R}{O}{\signed-[Big]{R}{%
        \signed-[big]{O}{\key+{A},\key+{B},m,\chash{\nonce{O}}},
        \chash{\nonce{R}}}}[asw:2] \\
    \send{O}{R}{\nonce{O}}[asw:3] \\
    \send{R}{O}{\nonce{R}}[asw:4]    
  \end{steps}
\end{ltxex}

Two participants \apri{O} (originator) and \apri{R} (recipient) is
involved in this subprotocol.  In the complete protocol two other
subprotocols (\emph{abort} and \emph{resolve}) and a third participant
\apri{T} (third player) is included.  See \refltxcode{asw} for the
{\latex} code.


\tol{wmf}{Wide-mouthed-frog protocol}
The \emph{Wide-mouthed-frog protocol}~\cite{burrows1989a} (Section~7,
page~25) is a simple protocol that uses shared key cryptography and an
authentication server.  It transfers a key from \apri{A} to \apri{B}
via the authentication server \apri{S} in only two messages by using
synchronized clocks and by allowing \apri{A} to choose the session
key:

\begin{ltxex}{wmf}{Wide-mouthed-frog protocol}
  \begin{steps}
    \send[big]{A}{S}{A, \encrypted{A,S}{\ts{A}, \apri{B}, \key'{A,B}}}[wmf:1] \\
    \send*[big]{S}{B}{\encrypted{B,S}{\ts{S}, \apri{A}, \key'{A,B}}}[wmf:2]
  \end{steps}
\end{ltxex}

\apri{A} sends a time stamp \ts{A} and session key \key'{A,B} to
\apri{S}. \apri{S} checks that message \aref{wmf:1} is timely.  If it
is, it forwards the key \key'{A,B} to \apri{B} together with its own
timestamp \ts{S} in message \aref{wmf:2}.  \apri{B} then checks that
the timestamp \ts{S} from \apri{S} is later than any another it has
received from \apri{S}.


\tol{iwmf}{Idealized wide-mouthed-frog protocol}
The \emph{Idealized  wide-mouthed-frog protocol} with BAN logic is
shown below:

\begin{ltxex}{iwmf}{Idealized wide-mouthed-frog protocol}
  \begin{steps}
    \send*{A}{S}{\encrypted[big]{A,S}{\ts{A},
        \{\apri{A}\asharedkey{\key{A,B}}\apri{B}\}}}[iwmf:1] \\
    \send*[big]{S}{B}{\encrypted{B,S}{\ts{S},
        \apri{A}\believes\apri{A}\asharedkey{\key{A,B}}\apri{B}}}[iwmf:2]
  \end{steps}
\end{ltxex}


\tol{dwmf}{Wide-mouthed-frog protocol with declarations}
In \cite{briais2007a}, formal declarations as part of protocol
narrations is introduced.  We can do something similar with BAN logic
and {\aspen}, where we use BAN logic for the declaration part
(\aref{dwmf:1}--\aref{dwmf:3}).  The following example is similar to
their version of the \emph{Wide-mouthed-frog protocol with
  declarations} (see \cite{briais2007a}, Table~3, page~487):

\begin{ltxex}{dwmf}{Wide-mouthed-frog protocol with declarations}
  \begin{steps}[labels=D]
    \astep(D){\apri{A}\asharedkey{\key{A,S}}\apri{S};
      \apri{B}\asharedkey{\key{B,S}}\apri{S}}[dwmf:1] \\
    \astep(D){\apri{A}\sees\key'{A,B}; \fresh{\key'{A,B}};
      \apri{A}\sees\aval{m}}[dwmf:3] \\
    \send[big]{A}{S}{A,\encrypted{A,S}{\ts{A},\apri{B},\key'{A,B}}}[dwmf:4] \\
    \send*[big]{S}{B}{\encrypted{B,S}{\ts{S},\apri{A},\key'{A,B}}}[dwmf:5]
  \end{steps}
\end{ltxex}

See \refltxcode{wmf}, \refltxcode{iwmf} and \refltxcode{dwmf} for the
{\latex} code of the \emph{Wide-mouthed-frog protocol}, the
\emph{Idealized wide-mouthed-frog protocol} and the
\emph{Wide-mouthed-frog protocol with declarations}.


\tol{tls-hs}{TLS 1.3 Handshake}
The \emph{TLS 1.3 Handshake}~\cite{rescorla2018a} has three stages.
Stage one is the key exchange, stage two is the server parameters, and
stage three is authentication (we only include server authentication
in the example).  In the steps below stage one and three are included,
the key exchange algorithm used is DHE (Ephemeral Diffie-Hellman) and
we ignore PSK (Pre-Shared Key):

\begin{ltxex}{tls-hs}{TLS 1.3 Handshake}
  \begin{steps}
    \astepat*{C}{\fresh{\key-{C_e}}; \dhpubkeyf{C_e}[C_e]}[tls-hs:1] \\
    \send{C}{S}{\ldots, \nonce{C}, \key+{C_e}, \ldots}[tls-hs:2] \\
    \astepat*{S}{\fresh{\key-{S_e}}; \dhpubkeyf{S_e}[S_e]}[tls-hs:3] \\
    \send[big]{S}{C}{\ldots, \nonce{S}, \key+{S_e}, \cert-{CA}{S},
      \signed{S}{\nonce{C}, \nonce{S}, \ldots}, \ldots}[tls-hs:4] \\
    \astepat*{C}{\verify+{CA}{\cert-{CA}{S}}[\atrue];
      \verify+{S}{\signed{S}{\nonce{C}, \nonce{S},
          \ldots}}[\atrue]}[tls-hs:5a] \\
    \astepat*{C}{\dhkeyf{C_e}{S_e}[C,S]}[tls-hs:5b] \\
    \astepat*{S}{\dhkeyf{S_e}{C_e}[C,S]}[tls-hs:6] \\
    \send*{C}{S}{\encrypted{C,S}{\ldots}}[tls-hs:7] \\
    \send*{S}{C}{\encrypted{C,S}{\ldots}}[tls-hs:8]
  \end{steps}
\end{ltxex}

The example above is somewhat simplified to make it easier to follow
(some details are hidden and some optional pathways are ignored).
After message \ref{tls-hs:4} and step \ref{tls-hs:6} the client
\apri{C} and the server \apri{S} share a new fresh encryption key
\key{C,S} and the rest of the TLS handshake is encrypted.  Message
\ref{tls-hs:7} and message \ref{tls-hs:8} are the client handshake
finished and the server handshake finished messages, respectively.

\tol{smc-mean}{SMC: Calculate the mean value}
In~\cite{andersen2014a}, \emph{SMC} (secure multi-party computation)
algorithms for analyzing health data were discussed.  The first
algorithm from this paper is used to calculate the mean value of three
values \aval{V_1}, \aval{V_2} and \aval{V_3} from three participants
\apri{P_1}, \apri{P_2} and \apri{P_3} without sharing any knowledge
about the individual values.  A coordinator \apri{C} coordinates the
calculation.  The messages between from \apri{P_{i-1}} to \apri{P_i}
have the following structure (we can say that participant \apri{P_0}
and \apri{P_4} is the same individual with an alias \apri{C}):

\qquad
\begin{steps*}[lmarg=0pt]
  \msg[Big]{\encrypted+[big]{P_i}{\signed-{P_{i-1}}{\aval{V'_{i}}}},
    \encrypted+[big]{P_i}{\signed-{C}{\apri{P_{i-1}},\apri{P_{i+1}}}},
    \encrypted+[big]{P_{i+1}}{\signed-{C}{\apri{P_{i}},\apri{P_{i+2}}}},\ldots}
\end{steps*}

The first part of the message is the intermediate value received at
participant \apri{P_i} signed by the previous participant in the
calculation \apri{P_{i-1}}.  The second part is each path in the
calculation (where the input came from and where to send the
intermediate result). The current participant \apri{P_i} can decrypt
the first element that says the it should expect the input value from
participant \apri{P_{i-1}} and it should forwards the intermediate
result of its calculation to participant \apri{P_{i+1}}.  Each such
element is signed by the coordinator and encrypted with the public key
of the participant that should be able to read this information.  We
can now write the protocol used for the calculation of the mean value
\aval{M} using the {\aspen} notation (we ignore the signature
verification steps at each participant):

\begin{ltxex}{smc-mean}{SMC: Calculate the mean value}
  \begin{steps}\setcounter{counterS}{-1}%
    \astepat*{C}{$\aval{V'_0} = \random'{0}$; \fresh{\aval{V'_0}}}\\
    \send[Big]{C}{P_1}{%
      \encrypted+[big]{P_1}{\signed-{C}{\aval{V'_0}}},
      \encrypted+[big]{P_1}{\signed-{C}{\apri{C},\apri{P_2}}},
      \encrypted+[big]{P_2}{\signed-{C}{\apri{P_1},\apri{P_3}}},
      \encrypted+[big]{P_3}{\signed-{C}{\apri{P_2},\apri{C}}}} \\
    \astepat*{P_1}{$\aval{V'_1} = \aval{V'_0} + \aval{V_1}$} \\
    \send[Big]{P_1}{P_2}{%
      \encrypted+[big]{P_2}{\signed-{P_1}{\aval{V'_1}}},
      \encrypted+[big]{P_2}{\signed-{C}{\apri{P_1},\apri{P_3}}},
      \encrypted+[big]{P_3}{\signed-{C}{\apri{P_2},\apri{C}}}} \\
    \astepat*{P_2}{$\aval{V'_2} = \aval{V'_1} + \aval{V_2}$} \\
    \send[Big]{P_2}{P_3}{%
      \encrypted+[big]{P_3}{\signed-{P_2}{\aval{V'_2}}},
      \encrypted+[big]{P_3}{\signed-{C}{\apri{P_2},\apri{C}}}} \\
    \astepat*{P_3}{$\aval{V'_3} = \aval{V'_2} + \aval{V_3}$} \\
    \send[Big]{P_3}{C}{%
      \encrypted+[big]{C}{\signed-{P_3}{\aval{V'_3}}}} \\
    \astepat*{C}{$\aval{M} = (\aval{V'_3}-\aval{V'_0}) / \aval{3}$}
  \end{steps}
\end{ltxex}

\begin{figure}
  
  \hspace*{\fill}
  \begin{mplibcode}
    
    p1:=(width,0);
    p2:=(0,height);
    p3:=(-width,0);
    p4:=(width,-height);
    p5:=(width,height);
    p6:=(-width,height);
    p7:=(-width,-height);
    
    c:=(0,-height);
    
    draw object(p1, orad);
    label(btex \apri{P_1} etex, p1);
    label.rt(btex \alabel{S_1} etex, p1+(1.2orad,0));
    
    draw object(p2, orad);
    label(btex \apri{P_2} etex, p2);
    label.top(btex \alabel{S_2} etex, p2+(0,1.2orad));
    
    draw object(p3, orad);
    label(btex \apri{P_3} etex, p3);
    label.lft(btex \alabel{S_3} etex, p3+(-1.2orad,0));
      
    draw object(c, orad);
    draw object(c, orad-2pt);
    label(btex \apri{C} etex, c);
    label.bot(btex \alabel{S_0}, \alabel{S_4} etex, c+(0,-1.2orad));
      
    draw ddirarrow(c, 0, 90, p1, orad);
    label.lrt(btex \alabel{M_1} etex, c+(0.5width,0));
    
    draw ddirarrow(p1, 90, 180, p2, orad);
    label.urt(btex \alabel{M_2} etex, p2+(0.5width,0));
    
    draw ddirarrow(p2, 180, 270, p3, orad);
    label.ulft(btex \alabel{M_3} etex, p2+(-0.5width,0));
    
    draw ddirarrow(p3, 270, 0, c, orad);
    label.llft(btex \alabel{M_4} etex, c+(-0.5width,0));
    
  \end{mplibcode}
  \hspace*{\fill}
    
  \caption{SMC: Calculate the mean value}\label{fig:smc-mean}
  
\end{figure}

Figure \ref{fig:smc-mean} illustrates the participants and each step
and message of the calculation.  See \refltxcode{smc-mean} for the
{\latex} code.


\tol{csi-fs}{File sharing with symmetric and public key encryption}
Cloud Security Infrastructure (CSI)~\cite{andersen2014c} is a scalable
cloud storage architecture with focus on privacy.  In
\cite{andersen2014c}, a figure (Figure~3) illustrates how a user can
share a file with another user using a combination of symmetric
(secret) key and public key encryption.  In Figure~\ref{fig:csi-fs}
and in the protocol shown below, the intent of original figure in
~\cite{andersen2014c}is recreated using {\aspen}.  In the steps below,
\apri{A} uploads two files \aval{F_1} and \aval{F_2} to a server,
where file \aval{F_1} is shared with \apri{B}:

\begin{figure}
  \hspace*{\fill}
  \begin{mplibcode}
    
    d:=(0,0);
    p1:=(-1.3width,0);
    p2:=(1.3width,0);
    
    draw object(d, orad);
    draw object(d, orad-2pt);
    label(btex \apri{S} etex, d);

    label.bot(btex \boxed{\small
      \begin{array}{@{\:}c@{\:}}
        \cert!_{X509}{CA}{A} \\
        \cert!_{X509}{CA}{B} \\
        \sval[big]{\encrypted+{A}{\key{F_1}},
          \encrypted+{B}{\key{F_1}}, \encrypted{F_1}{F_1}} \\
        \sval[big]{\encrypted+{A}{\key{F_2}},
          \encrypted{F_2}{F_2}}
      \end{array}} etex, d+(0,-2.3orad));

    draw object(p1, orad);
    label(btex $A$ etex, p1);

    label.lft(btex \boxed{\small
      \begin{array}{@{\:}c@{\:}}
        \encrypted"_{PCKS\#12}{P_A}{\key-{A}} \\
        \cert!_{X.509}{CA}{A} \\
        \cert!_{X.509}{CA}{B} \\
        \aval{F_1} \\
        \aval{F_2}
      \end{array}} etex, p1+(-1.2orad,0));
      
    draw ddirarrow(p1, 0+v, 0-v, d, orad);
    label.top(btex 
    \alabel{M_1}
    etex,
    (d+p1)/2+(0,1.1orad));

    draw ddirarrow(p1, 0-v, 0+v, d, orad);
    label.bot(btex 
    \alabel{M_2}
    etex, (d+p1)/2+(0,-1.2orad));
    
    draw object(p2, orad);
    label(btex \apri{B} etex, p2);

    label.rt(btex \boxed{\small
      \begin{array}{@{\:}c@{\:}}
        \encrypted"_{PCKS\#12}{P_B}{\key-{B}} \\
        \cert!_{X.509}{CA}{B} \\
        \cert!_{X.509}{CA}{A} \\
        \aval{F_1}
      \end{array}} etex, p2+(1.2orad,0));
      
    draw ddirarrow(d, 0, 0, p2, orad);
    label.top(btex 
    \alabel{M_3}
    etex,
    (d+p2)/2+(0,0.1orad));

  \end{mplibcode}
  \hspace*{\fill}
  \caption{File sharing with symmetric and public key encryption}
  \label{fig:csi-fs}
\end{figure}

\begin{ltxex}{csi-fs}{File sharing with symmetric and public key encryption}
  \begin{steps}
    \astepat*{A}{\fresh{\key{F_1}}; \fresh{\key{F_2}}} \\
    \astepat*{A}{%
      \encrypt{F_1}{F_1}[*];
      \encrypt{F_2}{F_2}[*]} \\
    \astepat*{A}{%
      \encrypt+{A}{\key{F_1}}[*];
      \encrypt+{B}{\key{F_1}}[*]} \\
    \astepat*{A}{\encrypt+{A}{\key{F_2}}[*]} \\
    \send[big]{A}{S}{\encrypted+{A}{\key{F_1}},
      \encrypted+{B}{\key{F_1}}, \encrypted{F_1}{F_1}} \\
    \send[big]{A}{S}{\encrypted+{A}{\key{F_2}},
        \encrypted{F_2}{F_2}} \\
    \send[big]{S}{B}{\encrypted+{A}{\key{F_1}},
      \encrypted+{B}{\key{F_1}}, \encrypted{F_1}{F_1}} \\
    \astepat*{B}{%
      \decrypt"{P_B}{\encrypted"{P_B}{\key-{B}}}[\key-{B}];
      \decrypt-{B}{\encrypted+{B}{\key{F_1}}}[\key{F_1}]} \\
    \astepat*{B}{\decrypt{F_1}{\encrypted{F_1}{F_1}}[\aval{F_1}]}
  \end{steps}
\end{ltxex}

In Figure~\ref{fig:csi-fs}, the boxes illustrate what is stored at each
principal (data at-rest) and the arrows illustrate the messages sent
between the principals (data in-transit).  Each messages in the figure
is labeled with the same labels used in the steps shown above.


\tol{csi-ssfs}{Scalable secure file sharing}
The Cloud Security Infrastructure (CSI)~\cite{andersen2014c} has come
up with the concept of a \emph{store} and a \emph{share} to achieve
scalable secure file sharing.  Every principal has a store that is
represented by a public and private key pair (\key+{S_A} and
\key-{S_A} for \apri{A} in the example below).  When a file is shared,
a new store called a share is created.  In the example below a share
represented by the public and private key pair \key+{S_{A,B}} and
\key-{S_{A,B}} is used to share file \aval{F_1} between \apri{A} and
\apri{B}.  Each store (and share) also has a symmetric random
encryption key associated with them (\key{S_A} and \key{S_{A,B}} in
the example) used to encrypt the private keys of the stores:

\begin{figure}
  \hspace*{\fill}
  \begin{mplibcode}
    
    d:=(0,0);
    p1:=(-1.3width,0);
    p2:=(1.3width,0);
    
    draw object(d, orad);
    draw object(d, orad-2pt);
    label(btex \apri{S} etex, d);

    label.bot(btex \boxed{\small
      \begin{array}{@{\:}c@{\:}}
        \cert!_{X509}{CA}{A} \\
        \cert!_{X509}{CA}{B} \\
        \key+{S_A}, \encrypted{S_A}{\key-{S_A}} \\
        \encrypted+{A}{\key{S_A}} \\
        \key+{S_{A,B}}, \encrypted{S_{A,B}}{\key-{S_{A,B}}} \\
        \encrypted+{A}{\key{S_{A,B}}}, \encrypted+{B}{\key{S_{A,B}}} \\
        \sval[big]{\encrypted+{S_{A,B}}{\key{F_1}},
          \encrypted+{B}{\key{F_1}}, \encrypted{F_1}{F_1}} \\
        \sval[big]{\encrypted+{S_A}{\key{F_2}},
          \encrypted{F_2}{F_2}}
      \end{array}} etex, d+(0,-2.3orad));

    draw object(p1, orad);
    label(btex $A$ etex, p1);

    label.lft(btex \boxed{\small
      \begin{array}{@{\:}c@{\:}}
        \encrypted"_{PCKS\#12}{P_A}{\key-{A}} \\
        \cert!_{X.509}{CA}{A} \\
        \cert!_{X.509}{CA}{B} \\
        \key+{S_A}, \encrypted{S_A}{\key-{S_A}} \\
        \encrypted+{A}{\key{S_A}} \\
        \key+{S_{A,B}}, \encrypted{S_{A,B}}{\key-{S_{A,B}}} \\
        \encrypted+{A}{\key{S_{A,B}}} \\
        \aval{F_1} \\
        \aval{F_2}
      \end{array}} etex, p1+(-1.2orad,0));
      
    draw ddirarrow(p1, 0+v, 0-v, d, orad);
    label.top(btex 
    $\alabel{M_1},\alabel{M_2}$
    etex,
    (d+p1)/2+(0,1.1orad));

    draw ddirarrow(p1, 0-v, 0+v, d, orad);
    label.bot(btex 
    $\alabel{M_3},\alabel{M_4}$
    etex, (d+p1)/2+(0,-1.2orad));
    
    draw object(p2, orad);
    label(btex \apri{B} etex, p2);

    label.rt(btex \boxed{\small
      \begin{array}{@{\:}c@{\:}}
        \encrypted"_{PCKS\#12}{P_B}{\key-{B}} \\
        \cert!_{X.509}{CA}{B} \\
        \cert!_{X.509}{CA}{A} \\
        \key+{S_{A,B}}, \encrypted{S_{A,B}}{\key-{S_{A,B}}} \\
        \encrypted+{B}{\key{S_{A,B}}} \\
        \aval{F_1}
      \end{array}} etex, p2+(1.2orad,0));
      
    draw ddirarrow(d, 0+v, 0-v, p2, orad);
    label.top(btex 
    \alabel{M_5}
    etex,
    (d+p2)/2+(0,1.1orad));

    draw ddirarrow(d, 0-v, 0+v, p2, orad);
    label.bot(btex 
    \alabel{M_6}
    etex,
    (d+p2)/2+(0,-1.2orad));

  \end{mplibcode}
  \hspace*{\fill}
  \caption{Scalable secure file sharing}
  \label{fig:csi-ssfs}
\end{figure}

\begin{ltxex}{csi-ssfs}{Scalable secure file sharing}
  \begin{steps}
    \astepat*{A}{%
      \fresh{\key{F_1}}; \fresh{\key{F_2}};
      \fresh{\key{S_A}}; \fresh{\key{S_{A,B}}};
      \fresh{\key-{S_A}}; \fresh{\key+{S_A}};
      \fresh{\key-{S_{A,B}}}; \fresh{\key+{S_{A,B}}}} \\
    \astepat*{A}{%
      \encrypt{F_1}{F_1}[*];
      \encrypt{F_2}{F_2}[*]} \\
    \astepat*{A}{%
      \encrypt+{S_{A,B}}{\key{F_1}}[*];
      \encrypt+{S_A}{\key{F_2}}[*]} \\
    \astepat*{A}{%
      \encrypt{S_A}{\key-{S_A}}[*];
      \encrypt{S_{A,B}}{\key-{S_{A,B}}}[*]} \\
    \astepat*{A}{%
      \encrypt+{A}{\key{S_A}}[*]} \\
    \astepat*{A}{%
      \encrypt+{A}{\key{S_{A,B}}}[*];
      \encrypt+{B}{\key{S_{A,B}}}[*]} \\
    \send[big]{A}{S}{\encrypted+{A}{\key{S_A}}, \encrypted+{A}{\key{S_{A,B}}},
      \encrypted+{B}{\key{S_{A,B}}}} \\
    \send[big]{A}{S}{\encrypted{S_A}{\key-{S_A}},
      \encrypted{S_{A,B}}{\key-{S_{A,B}}}} \\
    \send[big]{A}{S}{\encrypted+{S_{A,B}}{\key{F_1}}, \encrypted{F_1}{F_1}} \\
    \send[big]{A}{S}{\encrypted+{S_A}{\key{F_2}}, \encrypted{F_2}{F_2}} \\
    \send[big]{S}{B}{\encrypted+{B}{\key{S_{A,B}}},
      \encrypted{S_{A,B}}{\key-{S_{A,B}}}} \\
    \send[big]{S}{B}{\encrypted+{S_{A,B}}{\key{F_1}}, \encrypted{F_1}{F_1}} \\
    \astepat*{B}{%
      \decrypt"{P_B}{\encrypted"{P_B}{\key-{B}}}[\key-{B}];
      \decrypt-{B}{\encrypted+{B}{\key{S_{A,B}}}}[\key{S_{A,B}}]} \\
    \astepat*{B}{%
      \decrypt{S_{A,B}}{\encrypted{S_{A,B}}{\key-{S_{A,B}}}}[\key-{S_{A,B}}];
      \decrypt-{S_{A,B}}{\encrypted+{S_{A,B}}{\key{F_1}}}[\key{F_1}]} \\
    \astepat*{B}{\decrypt{F_1}{\encrypted{F_1}{F_1}}[\aval{F_1}]}
  \end{steps}
\end{ltxex}

In Figure~\ref{fig:csi-ssfs} presenting the example, the boxes
illustrate what is stored at each principal (data at-rest) and the
arrows illustrate the messages sent between the principals (data
in-transit).  Each messages in the figure is labeled with the same
labels used in the steps shown above.  Figure~\ref{fig:csi-ssfs} is a
recreation of a figure in \cite{andersen2014c} (Figure~4) illustrating
the same example as the one above.


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\appendix
\clearpage


\bibliographystyle{splncs04x}
\bibliography{aspen-doc}


\clearpage
\section{Notes}


\subsection{Notes on the suggested notation}
\label{sec:notes-notation}

The notations used for security protocols in different articles and
textbooks is not consistent. {\aspen} is an attempt to create one
consistent notation. Mostly, for my own usage, but if the suggested
notation is found useful for others, it is a nice bonus.  The notation
is also influenced by my background as a programmer and not a
mathematician or a theoretical computer scientist.  In the following,
the choices of {\aspen} will be discussed and compared with similar
notations used in articles and textbooks.  This is not an attempt to
provide a complete overview over existing notations and how they
compare to {\aspen}.  It is more a discussion of notations that
inspired {\aspen} and the choices made in the suggested notation.
\href{mailto:Anders.Andersen@uit.no?subject=Feedback Aspen}{Feedback}
on the notation are welcome.

Below, {\aspen} is compared with the notation used in litterateur.
The following sources of different notations are used:
\vspace*{-1.7ex}
\begin{enumerate}
\item {\aspen} \label{not:aspen}
\item Kerberos: An Authentication Service for Open Network Systems~\cite{steiner1988a} \label{not:kerberos}
\item A formal semantics for protocol narrations~\cite{briais2007a} \label{not:prot-narrations}
\item Security Engineering: A Guide to Building Dependable Distributed Systems~\cite{anderson2020a} \label{not:anderson}
\item Current Approaches to Authentication in Wireless and Mobile Communications Networks~\cite{schafer2001a} \label{not:mob}
\end{enumerate}

\newcolumntype{C}{>{\small}c}
\newcolumntype{Y}{>{\small\centering}X}
{\renewcommand{\arraystretch}{1.3}
  \begin{xltabular}{\textwidth}{lYYYYYc}\Xhline{0.5pt}
    \textbf{Description}
    & \textbf{\ref{not:aspen}}
    & \textbf{\ref{not:kerberos}}
    & \textbf{\ref{not:prot-narrations}}
    & \textbf{\ref{not:anderson}}
    & \textbf{\ref{not:mob}}
    & $\mathbf{\ast}$ \\\Xhline{0.5pt}
    Secret key
    & \key{A}
    & \akey{K_A}
    & \akey{k_A}
    & \akey{K}
    & \akey{K_A}
    & C \\
    Shared key
    & \key{A,B}
    & $-$
    & \akey{k_{A\;B}}
    & $-$
    & $-$
    & C \\
    Session key
    & \key'{A,B}
    & \akey{K_{A,\averythinspace B}}
    & $-$
    & $-$
    & $-$
    & B \\
    Public key
    & \key+{A}
    & $-$
    & \akey{\textrm{pub}(k_A)}
    & \akey{KR}
    & \akey{+K_A}
    & A \\
    Private key
    & \key-{A}
    & $-$
    & \akey{\textrm{priv}(k_A)}
    & \akey{KR^{-1}}
    & \akey{-K_A}
    & A \\
    Encrypted
    & \encrypted*{\akey{K}}{m}
    & $\msg{m}\akey{K}$
    & $\msg{m}_{\akey{K}}$
    & $\msg{m}_{\akey{K}}$
    & $\msg{m}_{\akey{K}}$
    & C \\
    Signed with
    & \signed*{\akey{K}}{m}
    & $-$
    & $-$
    & \aval{\textrm{sig}_{\akey{K}}\{m\}}
    & $-$
    & A \\
    Signed by
    & \signed!{A}{m}
    & $-$
    & $-$
    & $-$
    & \aval{\apri{A}\,[m]}
    & A \\
    Send
    & \csend{A}{B}{m}
    & \raisebox{-1.5pt}{%
\begin{mplibcode}
  draw fullcircle scaled 10pt shifted (-10pt,0);
  label(btex $\scriptstyle \apri{A}$ etex, (-10pt,0));
  drawarrow (-5pt,0)--(5pt,0);
  label(btex $\scriptstyle \aval{m}$ etex, (0,3.5pt));
  draw fullcircle scaled 10pt shifted (10pt,0);
  label(btex $\scriptstyle \apri{B}$ etex, (10pt,0));
\end{mplibcode}}
    & $\apri{A}\!\leadsto\!\apri{B}\!:\!\aval{m}$
    & $\apri{A}\!\csends\!\apri{B}\!:\!\aval{m}$
    & $\apri{A}\!\csends\!\apri{B}\!:\!\aval{m}$
    & B \\
    Hash value
    & \chash{m}
    & $-$
    & \aval{\textrm{H}(m)}
    & \aval{\textit{h}(m)}
    & \aval{\textit{H}(m)}
    & B \\
    MAC
    & \mac*{\akey{K}}{m}
    & $-$
    & $-$
    & \aval{\textrm{MAC}_{\akey{K}}(m)}
    & $-$
    & B \\
    HMAC
    & \hmac*{\akey{K}}{m}
    & $-$
    & $-$
    & \aval{\textrm{HMAC}_{\akey{K}}(m)}
    & $-$
    & B \\
    Signature
    & \sig*{\akey{K}}{m}
    & $-$
    & $-$
    & $-$
    & $-$
    & A \\
    Certificate
    & \certificate-{CA}{\apri{A},\key+{A}}
    & $-$
    & $-$
    & \aval{\textit{Cert}_{\akey{KC^{-1}}}\!(A,\akey{KR})}
    & \aval{\textit{Cert}_{\akey{-K_{CA}}}\!(\akey{+K_A})}
    & B \\
    Certificate by
    & \certificate!{CA}{\apri{A},\key+{A}}
    & $-$
    & $-$
    & $-$
    & \aval{\apri{CA}\,\langle\langle\,\apri{A}\,\rangle\rangle}
    & A \\\Xhline{0.5pt}
  \end{xltabular}}\vspace*{-.5\baselineskip}

In the table, the rightmost column classifies the notation in these groups:
\vspace*{-1.7ex}
\begin{itemize}
\item[C:] The notation is commonly used in textbooks and other publications
\item[B:] The notation (or similar) is found in textbooks and other publications
\item[A:] The notation is believed to be unique for {\aspen} (invented here)
\end{itemize}

% The notation used in the original Kerberos documentation includes
% secret keys (called private keys, but they are not the private key of
% a public-private key pair), session keys and encrypted messages.


\subsection{Notes on the typesetting options}
\label{sec:notes-options}


\subsubsection*{Colors}

The {\latex} package \acmd{aspen} provides the option \acmd{color}:

\begin{quote}
\acmd{\Verb|\usepackage[color]{aspen}|}
\end{quote}

The package provides different color profiles. The default color
profile is called \acmd{aspen}. Other color profiles are loaded by
assigning a color profile to the \acmd{color} option. The following
statement will load the same default color profile as the example
above:

\begin{quote}
\acmd{\Verb|\usepackage[color=aspen]{aspen}|}
\end{quote}

In addition, a few color profiles from
\href{https://pygments.org/}{Pygments} are available:
\acmd{autumn}, \acmd{colorful},
\acmd{default} (the default profile of Pygments),
\acmd{emacs}, \acmd{friendly},
%\acmd{fruity},
\acmd{gruvboxlight} (called \acmd{gruvbox-light} in Pygments),
\acmd{manni}, and \acmd{staroffice}.  Figure \ref{fig:color-profiles}
shows the colors of all the color profiles of the {\aspen} package.

\makeatletter
\def\mkcolorprofiletbl#1{%
  \begin{tabular}[c]{l@{\,\,}cl}
    \multicolumn{3}{l}{\textbf{\acmd{#1}}} \\\hline
    Value & \texttt{\small no} & {\csname #1@PY@tok@no\endcsname
            \PY@tc{\@aval{1}}, \PY@tc{\@atrue}} \\
    Principle & \texttt{\small na} & {\csname #1@PY@tok@na\endcsname
            \PY@tc{\@apri{A}}} \\
    Key & \texttt{\small kt} & {\csname #1@PY@tok@kt\endcsname
            \PY@tc{\@sharedkey{K}{A}}} \\
    Nonce & \texttt{\small nn} & {\csname #1@PY@tok@nn\endcsname
            \PY@tc{\@anonce{N_1}}} \\
    Timestamp & \texttt{\small nt} & {\csname #1@PY@tok@nt\endcsname
            \PY@tc{\@ats{T_s}}} \\
    String & \texttt{\small sc} & {\csname #1@PY@tok@sc\endcsname
             \PY@tc{\@astr{Hello}}} \\
    Variable & \texttt{\small nv} & {\csname #1@PY@tok@nv\endcsname
               \PY@tc{\@avar{x}}, \PY@tc{\@avar{y}}, \PY@tc{\@avar{z}}} \\
    Function & \texttt{\small nf} & {\csname #1@PY@tok@nf\endcsname
               \PY@tc{\@afunc{H(\@aval{m})}}} \\
    Code & \texttt{\small go} & {\csname #1@PY@tok@gp\endcsname
           \PY@tc{\@acmd{\textbackslash key\{A\}}}} \\
    Label & \texttt{\small nl} & {\csname #1@PY@tok@nl\endcsname
           \PY@tc{\@alabel{M_1}}}
  \end{tabular}}%
\makeatother

\begin{figure}
  \begin{center}
    \mkcolorprofiletbl{aspen}\qquad
    \mkcolorprofiletbl{autumn}\qquad
    \mkcolorprofiletbl{colorful}\\[.5em]
    \mkcolorprofiletbl{default}\qquad
    \mkcolorprofiletbl{emacs}\qquad
    \mkcolorprofiletbl{friendly}\\[.5em]
    % \mkcolorprofiletbl{fruity}\qquad
    \mkcolorprofiletbl{gruvboxlight}\qquad
    \mkcolorprofiletbl{manni}\qquad
    \mkcolorprofiletbl{staroffice}
  \end{center}
  \caption{The color profiles of the
    \texttt{\textcolor{NavyBlue}{aspen}} package}
  \label{fig:color-profiles}
\end{figure}


\subsubsection*{Other typesetting options}

\makeatletter
\def\tradpubkey#1{\@tradpubkey{K}{#1}}%
\def\tradprivkey#1{\@tradprivkey{K}{#1}}%
\makeatother

The default way of typesetting the public and the private key of the
public-private key pair of \apri{A} in {\aspen} is with a $+$
superscript and a $-$ superscript, like \key+{A} and \key-{A}
respectively. This behavior can be changed with the to package options
\acmd{tradpubkey} and \acmd{tradprivkey}:

\begin{quote}
\acmd{\Verb|\usepackage[tradpubkey,tradprivkey]{aspen}|}
\end{quote}

The result is that the public key of \apri{A} will be typeset
\akey{\tradpubkey{A}} and the private key of \apri{A} will be typeset
\akey{\tradprivkey{A}}.

The default way of typesetting concatenation in {\aspen} is with the
binary operator ``$\aconcat$'' (used to typeset concatenation of two
values or strings).  The {\aspen} package provides three options for
typesetting concatenation: ``$\adotconcat$'', ``$\adblbarconcat$'', or
``$\aplusconcat$''. This can be changed by passing a value to the
\acmd{concat} option of the package.  The valid values are
\acmd{dot}, \acmd{dblbar}, and \acmd{plus}.  The
default is ``$\aconcat$''. In this example ``$\adblbarconcat$'' is
chosen to be the concatenation operator:

\begin{quote}
\acmd{\Verb|\usepackage[concat=dblbar]{aspen}|}
\end{quote}

\clearpage
\subsection{Notation example listing}
\label{sec:ex-code}

In this Section, all notation examples with their {\latex} code is
listed without comments and any explanation.

\immediate\closeout\locfile
\input{\jobname.loc}

\end{document}
