Which four principles must every protocol satisfy?

• Two or more parties are involved, and each knows the protocol in advance.
• All parties follow the protocol.
• It is unambiguous: every step is exactly defined.
• It is complete: there is a defined action for every possible situation.

These four rules are what separate a protocol from "some messages that usually work":

1. Known in advance by all parties: you cannot negotiate the meaning of a message while receiving it. If the client and server disagree about what a field means, authentication silently fails or, worse, succeeds wrongly.
2. Followed by everyone: a protocol's security guarantees only hold if every participant executes it. A party that skips a check (say, a client that does not validate a signature) breaks the guarantee for everyone.
3. Unambiguous: each step must have one interpretation. Ambiguity is a classic source of attacks, where an attacker crafts a message that one side reads one way and the other side another way.
4. Complete: the protocol must say what to do for every case, including errors, timeouts and unexpected messages. Undefined situations are where implementations improvise, and improvised error handling is a common source of vulnerabilities.

Tip: OAuth and OIDC specifications are long precisely because of rule 4: much of their text describes error responses and validation steps, not the happy path.

Go deeper:

• Communication protocol (Wikipedia) — the general requirements a protocol must meet, with examples from networking.