RIPEMD with Two-Round Compress Function is Not Collision-Free.

Hans Dobbertin RIPEMD with Two-Round Compress Function is Not Collision-Free. 51-70 1997 10 J. Cryptology 1 db/journals/joc/joc10.html#Dobbertin97