Good variants of HB+ are hard to find (2008)

by H Gilbert, M J Robshaw, Y Seurin
Venue:In Financial Cryptography and Data Security