On the impossibility of three-move blind signature schemes
Optimal Security Proofs for PSS and Other Signature Schemes