for brevity, skipping the security-relevant details