MD2 Is not Secure without the Checksum Byte. - N. Rogier; Pascal Chauvaud (Des. Codes Cryptogr., 1997)