Secure hash-and-sign signatures without the random oracle
On the generation of cryptographically strong pseudorandom sequences