Threat model -- what we aim for Protect against somebody watching Alice Protect against curious Bob Protect against `some' curious nodes in the middle