Henri Gilbert Matthew J. B. Robshaw Yannick Seurin Good Variants of HB<sup>+</sup> Are Hard to Find. 156-170 2008 Financial Cryptography http://dx.doi.org/10.1007/978-3-540-85230-8_12 conf/fc/2008 db/conf/fc/fc2008.html#GilbertRS08