Arjen Lenstra
We show how the generation of a random integer k modulo q and the subsequent computation of k-1 mod q during the signature phase of the NIST digital signature algorithm (DSA) can be replaced by the simultaneous generation of a pair (k,k-1
1996