[nav1]

There's a link to it in that conversation: https://eprint.iacr.org/2014/904.pdf