Security specification: completeness, feasibility, refinement

The formal methods and refinement community should be able to contribute to the specification and verification of security protocols. This talk describes a few of the essential differences, or problems. First, security properties go beyond functional correctness, and are fundamentally different for different applications. Moreover, tomorrow's attacks may not be anticipated by yesterday's security properties. Second, notions of security may not be absolute: it may be good enough if guessing our secret is merely hard rather than impossible - and in some cases that may be provably the best we can get. Where does that leave us in wanting to provide security protocols ''correct by construction''?