Verified Security of Merkle-Damgård | doi.page