Forgery and Partial Key-Recovery Attacks on HMAC and NMAC Using Hash Collisions