Moshe Deutsch Martin C. Henson Steve Reeves Results on Formal Stepwise Design in Z. 33-42 2002 conf/apsec/2002 APSEC http://csdl.computer.org/comp/proceedings/apsec/2002/1850/00/18500033abs.htm db/conf/apsec/apsec2002.html#DeutschHR02