I. B. Damgård and L. R. Knudsen, “The breaking of the AR Hash Function”, DPB, vol. 22, no. 449, Jul. 1993.