and share knowledge among themselves. Hence, we can replace the (collaboration of) adversaries with a single principal who possesses all their knowledge, without excluding any intrusion scenarios.

In our example, the flow of knowledge from the intruder’s perspective starts with the protocol initialization message $E_{PK(B)}(A, N_A)$, since Oscar needs no prior knowledge to learn the first cipher that Alice sends to Bob. In general, because Oscar includes the untrusted public network, he learns the first message of the protocol for free, regardless of who its intended recipient and sender are: $$\forall_{p\in \{a,b\}, p'\in \{a,b\}\cup O} \ [\emptyset \rightarrow E_{PK(p')}(I(p),N(\epsilon,I(p)))].\label{ns1}$$ The variables $a$ and $b$ denote the honest principals (Alice and Bob), and the set $O$ stands for Oscar. The notation $N(\epsilon,I(p))$ represents the nonce that the nonce primitive $N$ generated for the principal identified by $I(p)$ using the random value $\epsilon$ as the seed. For example, Alice’s identity is $I(a)=A$ and Alice’s nonce is $N(\epsilon,I(a))=N_A$. The empty set means that Oscar does not need prior knowledge to learn $E_{PK(p')}(I(p),N(\epsilon,I(p)))$.

Once his pool of knowledge includes $E_{PK(B)}(A, N_A)$, Oscar learns the corresponding response, $E_{PK(A)}(N_A, N_B)$. More generally[^1], $$\begin{aligned}
\forall_{p'\in \{a,b\}, p\in \{a,b\}\cup O, v\in V} [c \rightarrow E_{PK(p)}(v,N(c,I(p')))] \label{ns2}  \\
\mbox{where 