Daniel R. L. Brown Donald Byron Johnson Formal Security Proofs for a Signature Scheme with Partial Message Recovery. 126-142 2001 conf/ctrsa/2001 CT-RSA http://link.springer.de/link/service/series/0558/bibs/2020/20200126.htm db/conf/ctrsa/ctrsa2001.html#BrownJ01