Composability So nondeducibility doesn't compose Neither does noninterference Many things can go wrong – clash of timing mechanisms, interaction of ciphers, interaction of protocols Practical problem: lack of good security interface definitions (we'll talk later about API failures) Labels can depend on data volume, or even be non-monotone (e.g.
{}