John Black Martin Cochran Thomas Shrimpton On the Impossibility of Highly-Efficient Blockcipher-Based Hash Functions. 311-329 2009 22 J. Cryptology 3 http://dx.doi.org/10.1007/s00145-008-9030-1 db/journals/joc/joc22.html#BlackCS09