On the Impossibility of Highly-Efficient Blockcipher-Based Hash Functions

John Black
Thomas Shrimpton
EUROCRYPT (2005), pp. 526-541

Abstract