We are very grateful to Dawn Song for her help with the security proof and to Michael Steiner for useful discussions. We would also like to thank the anonymous referees for their helpful comments. We are indebted to Markus Kuhn for his helpful editorial advice.