(Merge(p_b),v,Merge(p_a),Merge(k_a))\\
&&\mbox{where } r = (p_b,v,p_a,k_a) \in R
\end{array}$$ The merging of adversaries does not rule out any attacks because $Merge(f^*_R(k_0))\subseteq f^*_{Merge(R)}(Merge(k_0))$. We subsequently assume that $Merge$ is implied and use $P$, $R$, and $k_0$ to refer to $Merge(P)$, $Merge(R)$, and $Merge(k_0)$.

Security properties of protocols are expressed as predicates on the values known to Oscar in the maximal state of knowledge. We therefore restrict our analysis of knowledge flows to finding all the values in the projection of $f^*_{R(k_0)}(k_0)$ on Oscar. Specifically, we introduce the projection function $g_{R,k_0}$ and show that its smallest fixed point is the image of Oscar under $f^*_{R(k_0)}(k_0)$.

\[defarrow\] Let $X \rightarrow x$ denote the existence of a rule $(p,x,o,k_\sigma)\in R(k_0)$ for some $p\in P-\{o\}$ and $k_\sigma\in K$ with $X=\{v :(o,v)\in k_\sigma\}$. We define $g_{R,k}: 2^V \longrightarrow 2^V$ as $$g_{R,k_0}(X)=X\cup \left\{ x : X_\sigma \rightarrow x 
\mbox{ for some } X_\sigma\subseteq X \right\}.$$ The set of values reachable from $X$ is given by $g^*_{R,k_0}(X)$, which is the limit of $g_{R,k_0}^n(X)$ as $n\rightarrow \infty$.\[gR-def\]

Since $f_R(k_0)$ is monotonically increasing in $R$ and $k_0$, Oscar’s pool of values under $f^*_R(k_0)$ is maximized if (a) Oscar tells everything he knows to the honest principals and (b) the honest 