1. Specify an oracle (type of attack)
  2. Define what the adversary needs to do to win the game.
  3. The system is secure under the definition, if any efficient adversary wins the game with only negligible probability.