M.: Low-exponent llSA with related messages (1996)

by D Coppersmith, M Franklin, J Patarin, Reiter
Venue:In Advances in Cryptology - EUROCRYPT'96